Dispersed credentials

ABSTRACT

A method includes receiving, at a distributed storage (DS) unit, an access request from a requesting device. The access request includes a username and a user certificate, and the user certificate includes a user certificate signature. The user certificate is authenticated, and a domain name of a certificate authority (CA) associated with the user certificate is determined from information included in the access request. A CA certificate is obtained using the domain name of the CA, and the signature on the user certificate is validated using the CA certificate. The access request is approved in response to both 1) authenticating the user certificate, and 2) validating the user certificate signature using the CA certificate.

CROSS REFERENCE TO RELATED PATENTS

This application claims priority pursuant to 35 U.S.C. § 120 as acontinuation-in-part of U.S. Utility application Ser. No. 16/142,479,entitled “PREEMPTIVELY READING EXTRA ENCODED DATA SLICES”, filed Sep.26, 2018, scheduled to be issued as U.S. Pat. No. 10,496,500 on Dec. 3,2019, which is a continuation-in-part of U.S. Utility application Ser.No. 13/611,533, entitled “COPYING DATA IN A DISPERSED STORAGE NETWORKWITHOUT REPLICATION”, filed Sep. 12, 2012, now U.S. Pat. No. 10,445,164,issued Oct. 15, 2019, which claims priority pursuant to 35 U.S.C. §119(e) to U.S. Provisional Application No. 61/554,358, entitled“ACCESSING A DISPERSED STORAGE NETWORK”, filed Nov. 1, 2011, all ofwhich are incorporated herein by reference in their entirety and madepart of the present U.S. Utility Patent Application for all purposes.

BACKGROUND OF THE INVENTION Technical Field of the Invention

This invention relates generally to computing systems and moreparticularly to the use of dispersed credentials for access to suchcomputing systems.

Description of Related Art

Computers are known to communicate, process, and store data. Suchcomputers range from wireless smart phones to data centers that supportmillions of web searches, stock trades, or on-line purchases every day.In general, a computing system generates data and/or manipulates datafrom one form into another. For instance, an image sensor of thecomputing system generates raw picture data and, using an imagecompression program (e.g., JPEG, MPEG, etc.), the computing systemmanipulates the raw picture data into a standardized compressed image.

With continued advances in processing speed and communication speed,computers are capable of processing real time multimedia data forapplications ranging from simple voice communications to streaming highdefinition video. As such, general-purpose information appliances arereplacing purpose-built communications devices (e.g., a telephone). Forexample, smart phones can support telephony communications but they arealso capable of text messaging and accessing the internet to performfunctions including email, web browsing, remote applications access, andmedia communications (e.g., telephony voice, image transfer, musicfiles, video files, real time video streaming. etc.).

Each type of computer is constructed and operates in accordance with oneor more communication, processing, and storage standards. As a result ofstandardization and with advances in technology, more and moreinformation content is being converted into digital formats. Forexample, more digital cameras are now being sold than film cameras, thusproducing more digital pictures. As another example, web-basedprogramming is becoming an alternative to over the air televisionbroadcasts and/or cable broadcasts. As further examples, papers, books,video entertainment, home video, etc. are now being stored digitally,which increases the demand on the storage function of computers.

A typical computer storage system includes one or more memory devicesaligned with the needs of the various operational aspects of thecomputer's processing and communication functions. Generally, theimmediacy of access dictates what type of memory device is used. Forexample, random access memory (RAM) memory can be accessed in any randomorder with a constant response time, thus it is typically used for cachememory and main memory. By contrast, memory device technologies thatrequire physical movement such as magnetic disks, tapes, and opticaldiscs, have a variable response time as the physical movement can takelonger than the data transfer, thus they are typically used forsecondary memory (e.g., hard drive, backup memory, etc.).

A computer's storage system will be compliant with one or more computerstorage standards that include, but are not limited to, network filesystem (NFS), flash file system (FFS), disk file system (DFS), smallcomputer system interface (SCSI), internet small computer systeminterface (iSCSI), file transfer protocol (FTP), and web-baseddistributed authoring and versioning (WebDAV). These standards specifythe data storage format (e.g., files, data objects, data blocks,directories, etc.) and interfacing between the computer's processingfunction and its storage system, which is a primary function of thecomputer's memory controller.

Despite the standardization of the computer and its storage system,memory devices fail; especially commercial grade memory devices thatutilize technologies incorporating physical movement (e.g., a discdrive). For example, it is fairly common for a disc drive to routinelysuffer from bit level corruption and to completely fail after threeyears of use. One solution is to a higher-grade disc drive, which addssignificant cost to a computer.

Another solution is to utilize multiple levels of redundant disc drivesto replicate the data into two or more copies. One such redundant driveapproach is called redundant array of independent discs (RAID). In aRAID device, a RAID controller adds parity data to the original databefore storing it across the array. The parity data is calculated fromthe original data such that the failure of a disc will not result in theloss of the original data. For example, RAID 5 uses three discs toprotect data from the failure of a single disc. The parity data, andassociated redundancy overhead data, reduces the storage capacity ofthree independent discs by one third (e.g., n−1=capacity). RAID 6 canrecover from a loss of two discs and requires a minimum of four discswith a storage capacity of n−2.

While RAID addresses the memory device failure issue, it is not withoutits own failures issues that affect its effectiveness, efficiency andsecurity. For instance, as more discs are added to the array, theprobability of a disc failure increases, which increases the demand formaintenance. For example, when a disc fails, it needs to be manuallyreplaced before another disc fails and the data stored in the RAIDdevice is lost. To reduce the risk of data loss, data on a RAID deviceis typically copied on to one or more other RAID devices. While thisaddresses the loss of data issue, it raises a security issue sincemultiple copies of data are available, which increases the chances ofunauthorized access. Further, as the amount of data being stored grows,the overhead of RAID devices becomes a non-trivial efficiency issue.

BRIEF DESCRIPTION OF THE SEVERAL VIEWS OF THE DRAWING(S)

FIG. 1 is a schematic block diagram of an embodiment of a computingsystem in accordance with the present invention;

FIG. 2 is a schematic block diagram of an embodiment of a computing corein accordance with the present invention;

FIG. 3 is a schematic block diagram of an embodiment of a distributedstorage processing unit in accordance with the present invention;

FIG. 4 is a schematic block diagram of an embodiment of a grid module inaccordance with the present invention;

FIG. 5 is a diagram of an example embodiment of error coded data slicecreation in accordance with the present invention;

FIG. 6A is a schematic block diagram of another embodiment of acomputing system in accordance with the present invention;

FIG. 6B is a flowchart illustrating an example of copying data inaccordance with the present invention;

FIG. 6C is a diagram of a slice location table in accordance with thepresent invention;

FIG. 6D is a flowchart illustrating an example of cloning a slice inaccordance with the present invention;

FIG. 6E is a schematic block diagram of another embodiment of acomputing system in accordance with the present invention;

FIG. 6F is a flowchart illustrating an example of updating data inaccordance with the present invention;

FIG. 6G is a diagram of another slice location table in accordance withthe present invention;

FIG. 6H is a flowchart illustrating an example of updating a slice inaccordance with the present invention;

FIG. 7A is a schematic block diagram of another embodiment of acomputing system of a first step of a data update scenario in accordancewith the present invention;

FIG. 7B is a schematic block diagram of another embodiment of acomputing system of a second step of a data update scenario inaccordance with the present invention;

FIG. 7C is a schematic block diagram of another embodiment of acomputing system of a third step of a data update scenario in accordancewith the present invention;

FIG. 7D is a schematic block diagram of another embodiment of acomputing system of a fourth step of a data update scenario inaccordance with the present invention;

FIG. 7E is a flowchart illustrating an example of updating data storagein accordance with the present invention;

FIG. 7F is a flowchart illustrating an example of storing updated datain accordance with the present invention;

FIG. 7G is a flowchart illustrating an example of generating an updatedparity slice in accordance with the present invention;

FIG. 8A is a diagram illustrating an example of a directory inaccordance with the present invention;

FIG. 8B is a flowchart illustrating an example of storing data inaccordance with the present invention;

FIG. 9A is a diagram illustrating an example of an access request inaccordance with the present invention;

FIG. 9B is a schematic block diagram of an embodiment of a securitysystem for a distributed storage network (DSN) in accordance with thepresent invention;

FIG. 9C is a flowchart illustrating an example of accessing a dispersedstorage network (DSN) in accordance with the present invention;

FIG. 10A is a flowchart illustrating an example of establishing accessto a legacy service in accordance with the present invention;

FIG. 10B is a flowchart illustrating an example of accessing a legacyservice in accordance with the present invention;

FIG. 11A is a schematic block diagram of another embodiment of acomputing system in accordance with the present invention;

FIG. 11B is a diagram illustrating an example of a slice name inaccordance with the present invention;

FIG. 11C is a diagram illustrating an example of a vault in accordancewith the present invention;

FIG. 11D is a flowchart illustrating another example of storing data inaccordance with present invention;

FIG. 12A is a flowchart illustrating another example of generating anaccess request in accordance with present invention;

FIG. 12B is a flowchart illustrating another example of processing anaccess request in accordance with present invention;

FIG. 13A is a schematic block diagram of an embodiment of a system forstoring a large data object in a dispersed storage network (DSN) inaccordance with the present invention;

FIG. 13B is a schematic block diagram of an embodiment of a system forretrieving a large data object in a dispersed storage network (DSN) inaccordance with the present invention;

FIG. 13C is a schematic block diagram of another embodiment of a systemfor storing a large data object in a dispersed storage network (DSN) inaccordance with the present invention;

FIG. 13D is a flowchart illustrating another example of storing data inaccordance with the present invention;

FIG. 13E is a schematic block diagram of another embodiment of a systemfor retrieving a large data object in a dispersed storage network (DSN)in accordance with the present invention;

FIG. 13F is a flowchart illustrating an example of retrieving data inaccordance with the present invention; and

FIG. 14 is a flowchart illustrating another example of retrieving datain accordance with the present invention.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 is a schematic block diagram of a computing system 10 thatincludes one or more of a first type of user devices 12, one or more ofa second type of user devices 14, at least one distributed storage (DS)processing unit 16, at least one DS managing unit 18, at least onestorage integrity processing unit 20, and a distributed storage network(DSN) memory 22 coupled via a network 24. The network 24 may include oneor more wireless and/or wire lined communication systems; one or moreprivate intranet systems and/or public internet systems; and/or one ormore local area networks (LAN) and/or wide area networks (WAN).

The DSN memory 22 includes a plurality of storage units 36 that may belocated at geographically different sites (e.g., one in Chicago, one inMilwaukee, etc.), at a common site, or a combination thereof. Forexample, if the DSN memory 22 includes eight storage units 36, eachstorage unit is located at a different site. As another example, if theDSN memory 22 includes eight storage units 36, all eight storage unitsare located at the same site. As yet another example, if the DSN memory22 includes eight storage units 36, a first pair of storage units are ata first common site, a second pair of storage units are at a secondcommon site, a third pair of storage units are at a third common site,and a fourth pair of storage units are at a fourth common site. Notethat a DSN memory 22 may include more or less than eight storage units36. Further note that each storage unit 36 includes a computing core (asshown in FIG. 2, or components thereof) and a plurality of memorydevices for storing dispersed error encoded data

Each of the user devices 12-14, the DS processing unit 16, the DSmanaging unit 18, and the storage integrity processing unit 20 may be aportable computing device (e.g., a social networking device, a gamingdevice, a cell phone, a smart phone, a personal digital assistant, adigital music player, a digital video player, a laptop computer, ahandheld computer, a video game controller, and/or any other portabledevice that includes a computing core) and/or a fixed computing device(e.g., a personal computer, a computer server, a cable set-top box, asatellite receiver, a television set, a printer, a fax machine, homeentertainment equipment, a video game console, and/or any type of homeor office computing equipment). Such a portable or fixed computingdevice includes a computing core 26 and one or more interfaces 30, 32,and/or 33. An embodiment of the computing core 26 will be described withreference to FIG. 2.

With respect to the interfaces, each of the interfaces 30, 32, and 33includes software and/or hardware to support one or more communicationlinks via the network 24 indirectly and/or directly. For example,interfaces 30 support a communication link (wired, wireless, direct, viaa LAN, via the network 24, etc.) between the first type of user device14 and the DS processing unit 16. As another example, DSN interface 32supports a plurality of communication links via the network 24 betweenthe DSN memory 22 and the DS processing unit 16, the first type of userdevice 12, and/or the storage integrity processing unit 20. As yetanother example, interface 33 supports a communication link between theDS managing unit 18 and any one of the other devices and/or units 12,14, 16, 20, and/or 22 via the network 24.

In general. and with respect to data storage, the system 10 supportsthree primary functions: distributed network data storage management,distributed data storage and retrieval, and data storage integrityverification. In accordance with these three primary functions, data canbe distributedly stored in a plurality of physically different locationsand subsequently retrieved in a reliable and secure manner regardless offailures of individual storage devices, failures of network equipment,the duration of storage, the amount of data being stored, attempts athacking the data, etc.

The DS managing unit 18 performs distributed network data storagemanagement functions, which include establishing distributed datastorage parameters, performing network operations, performing networkadministration, and/or performing network maintenance. The DS managingunit 18 establishes the distributed data storage parameters (e.g.,allocation of virtual DSN memory space, distributed storage parameters,security parameters, billing information, user profile information,etc.) for one or more of the user devices 12-14 (e.g., established forindividual devices, established for a user group of devices, establishedfor public access by the user devices, etc.). For example, the DSmanaging unit 18 coordinates the creation of a vault (e.g., a virtualmemory block) within the DSN memory 22 for a user device (for a group ofdevices, or for public access). The DS managing unit 18 also determinesthe distributed data storage parameters for the vault. In particular,the DS managing unit 18 determines a number of slices (e.g., the numberthat a data segment of a data file and/or data block is partitioned intofor distributed storage) and a read threshold value (e.g., the minimumnumber of slices required to reconstruct the data segment).

As another example, the DS managing module 18 creates and stores,locally or within the DSN memory 22, user profile information. The userprofile information includes one or more of authentication information,permissions, and/or the security parameters. The security parameters mayinclude one or more of encryption/decryption scheme, one or moreencryption keys, key generation scheme, and data encoding/decodingscheme.

As yet another example, the DS managing unit 18 creates billinginformation for a particular user, user group, vault access, publicvault access, etc. For instance, the DS managing unit 18 tracks thenumber of times user accesses a private vault and/or public vaults,which can be used to generate a per-access bill. In another instance,the DS managing unit 18 tracks the amount of data stored and/orretrieved by a user device and/or a user group, which can be used togenerate a per-data-amount bill.

The DS managing unit 18 also performs network operations, networkadministration, and/or network maintenance. As at least part ofperforming the network operations and/or administration, the DS managingunit 18 monitors performance of the devices and/or units of the system10 for potential failures, determines the devices and/or unit'sactivation status, determines the devices' and/or units' loading, andany other system level operation that affects the performance level ofthe system 10. For example, the DS managing unit 18 receives andaggregates network management alarms, alerts, errors, statusinformation, performance information, and messages from the devices12-14 and/or the units 16, 20, 22. For example, the DS managing unit 18receives a simple network management protocol (SNMP) message regardingthe status of the DS processing unit 16.

The DS managing unit 18 performs the network maintenance by identifyingequipment within the system 10 that needs replacing, upgrading,repairing, and/or expanding. For example, the DS managing unit 18determines that the DSN memory 22 needs more DS units 36 or that one ormore of the DS units 36 needs updating.

The second primary function (i.e., distributed data storage andretrieval) begins and ends with a user device 12-14. For instance, if asecond type of user device 14 has a data file 38 and/or data block 40 tostore in the DSN memory 22, it send the data file 38 and/or data block40 to the DS processing unit 16 via its interface 30. As will bedescribed in greater detail with reference to FIG. 2, the interface 30functions to mimic a conventional operating system (OS) file systeminterface (e.g., network file system (NFS), flash file system (FFS),disk file system (DFS), file transfer protocol (FTP), web-baseddistributed authoring and versioning (WebDAV), etc.) and/or a blockmemory interface (e.g., small computer system interface (SCSI), internetsmall computer system interface (iSCSI), etc.). In addition, theinterface 30 may attach a user identification code (ID) to the data file38 and/or data block 40.

The DS processing unit 16 receives the data file 38 and/or data block 40via its interface 30 and performs a distributed storage (DS) process 34thereon (e.g., an error coding dispersal storage function). The DSprocessing 34 begins by partitioning the data file 38 and/or data block40 into one or more data segments, which is represented as Y datasegments. For example, the DS processing 34 may partition the data file38 and/or data block 40 into a fixed byte size segment (e.g., 21 to 2nbytes, where n=>2) or a variable byte size (e.g., change byte size fromsegment to segment, or from groups of segments to groups of segments,etc.).

For each of the Y data segments, the DS processing 34 error encodes(e.g., forward error correction (FEC), information dispersal algorithm,or error correction coding) and slices (or slices then error encodes)the data segment into a plurality of error coded (EC) data slices 42-48,which is represented as X slices per data segment. The number of slices(X) per segment, which corresponds to a number of pillars n, is set inaccordance with the distributed data storage parameters and the errorcoding scheme. For example, if a Reed-Solomon (or other FEC scheme) isused in an n/k system, then a data segment is divided into n slices,where k number of slices is needed to reconstruct the original data(i.e., k is the threshold). As a few specific examples, the n/k factormay be 5/3; 6/4; 8/6; 8/5; 16/10.

For each slice 42-48, the DS processing unit 16 creates a unique slicename and appends it to the corresponding slice 42-48. The slice nameincludes universal DSN memory addressing routing information (e.g.,virtual memory addresses in the DSN memory 22) and user-specificinformation (e.g., user ID, file name, data block identifier, etc.).

The DS processing unit 16 transmits the plurality of EC slices 42-48 toa plurality of DS units 36 of the DSN memory 22 via the DSN interface 32and the network 24. The DSN interface 32 formats each of the slices fortransmission via the network 24. For example, the DSN interface 32 mayutilize an internet protocol (e.g., TCP/IP, etc.) to packetize theslices 42-48 for transmission via the network 24.

The number of DS units 36 receiving the slices 42-48 is dependent on thedistributed data storage parameters established by the DS managing unit18. For example, the DS managing unit 18 may indicate that each slice isto be stored in a different DS unit 36. As another example, the DSmanaging unit 18 may indicate that like slice numbers of different datasegments are to be stored in the same DS unit 36. For example, the firstslice of each of the data segments is to be stored in a first DS unit36, the second slice of each of the data segments is to be stored in asecond DS unit 36, etc. In this manner, the data is encoded anddistributedly stored at physically diverse locations to improved datastorage integrity and security.

Each DS unit 36 that receives a slice 42-48 for storage translates thevirtual DSN memory address of the slice into a local physical addressfor storage. Accordingly, each DS unit 36 maintains a virtual tophysical memory mapping to assist in the storage and retrieval of data.

The first type of user device 12 performs a similar function to storedata in the DSN memory 22 with the exception that it includes the DSprocessing. As such, the device 12 encodes and slices the data fileand/or data block it has to store. The device then transmits the slices11 to the DSN memory via its DSN interface 32 and the network 24.

For a second type of user device 14 to retrieve a data file or datablock from memory, it issues a read command via its interface 30 to theDS processing unit 16. The DS processing unit 16 performs the DSprocessing 34 to identify the DS units 36 storing the slices of the datafile and/or data block based on the read command. The DS processing unit16 may also communicate with the DS managing unit 18 to verify that theuser device 14 is authorized to access the requested data.

Assuming that the user device is authorized to access the requesteddata, the DS processing unit 16 issues slice read commands to at least athreshold number of the DS units 36 storing the requested data (e.g., toat least 10 DS units for a 16/10 error coding scheme). Each of the DSunits 36 receiving the slice read command, verifies the command,accesses its virtual to physical memory mapping, retrieves the requestedslice, or slices, and transmits it to the DS processing unit 16.

Once the DS processing unit 16 has received a read threshold number ofslices for a data segment, it performs an error decoding function andde-slicing to reconstruct the data segment. When Y number of datasegments has been reconstructed, the DS processing unit 16 provides thedata file 38 and/or data block 40 to the user device 14. Note that thefirst type of user device 12 performs a similar process to retrieve adata file and/or data block.

The storage integrity processing unit 20 performs the third primaryfunction of data storage integrity verification. In general, the storageintegrity processing unit 20 periodically retrieves slices 45, and/orslice names, of a data file or data block of a user device to verifythat one or more slices have not been corrupted or lost (e.g., the DSunit failed). The retrieval process mimics the read process previouslydescribed.

If the storage integrity processing unit 20 determines that one or moreslices is corrupted or lost, it rebuilds the corrupted or lost slice(s)in accordance with the error coding scheme. The storage integrityprocessing unit 20 stores the rebuild slice, or slices, in theappropriate DS unit(s) 36 in a manner that mimics the write processpreviously described.

FIG. 2 is a schematic block diagram of an embodiment of a computing core26 that includes a processing module 50, a memory controller 52, mainmemory 54, a video graphics processing unit 55, an input/output (IO)controller 56, a peripheral component interconnect (PCI) interface 58,at least one IO device interface module 62, a read only memory (ROM)basic input output system (BIOS) 64, and one or more memory interfacemodules. The memory interface module(s) includes one or more of auniversal serial bus (USB) interface module 66, a host bus adapter (HBA)interface module 68, a network interface module 70, a flash interfacemodule 72, a hard drive interface module 74, and a DSN interface module76. Note the DSN interface module 76 and/or the network interface module70 may function as the interface 30 of the user device 14 of FIG. 1.Further note that the IO device interface module 62 and/or the memoryinterface modules may be collectively or individually referred to as IOports.

FIG. 3 is a schematic block diagram of an embodiment of a dispersedstorage (DS) processing module 34 of user device 12 and/or of the DSprocessing unit 16. The DS processing module 34 includes a gatewaymodule 78, an access module 80, a grid module 82, and a storage module84. The DS processing module 34 may also include an interface 30 and theDSnet interface 32 or the interfaces 68 and/or 70 may be part of user 12or of the DS processing unit 14. The DS processing module 34 may furtherinclude a bypass/feedback path between the storage module 84 to thegateway module 78. Note that the modules 78-84 of the DS processingmodule 34 may be in a single unit or distributed across multiple units.

In an example of storing data, the gateway module 78 receives anincoming data object that includes a user ID field 86, an object namefield 88, and the data field 40 and may also receive correspondinginformation that includes a process identifier (e.g., an internalprocess/application ID), metadata, a file system directory, a blocknumber, a transaction message, a user device identity (ID), a dataobject identifier, a source name, and/or user information. The gatewaymodule 78 authenticates the user associated with the data object byverifying the user ID 86 with the managing unit 18 and/or anotherauthenticating unit.

When the user is authenticated, the gateway module 78 obtains userinformation from the management unit 18, the user device, and/or theother authenticating unit. The user information includes a vaultidentifier, operational parameters, and user attributes (e.g., userdata, billing information, etc.). A vault identifier identifies a vault,which is a virtual memory space that maps to a set of DS storage units36. For example, vault 1 (i.e., user 1's DSN memory space) includeseight DS storage units (X=8 wide) and vault 2 (i.e., user 2's DSN memoryspace) includes sixteen DS storage units (X=16 wide). The operationalparameters may include an error coding algorithm, the width n (number ofpillars X or slices per segment for this vault), a read threshold T, awrite threshold, an encryption algorithm, a slicing parameter, acompression algorithm, an integrity check method, caching settings,parallelism settings, and/or other parameters that may be used to accessthe DSN memory layer.

The gateway module 78 uses the user information to assign a source name35 to the data. For instance, the gateway module 60 determines thesource name 35 of the data object 40 based on the vault identifier andthe data object. For example, the source name may contain a fileidentifier (ID), a vault generation number, a reserved field, and avault identifier (ID). As another example, the gateway module 78 maygenerate the file ID based on a hash function of the data object 40.Note that the gateway module 78 may also perform message conversion,protocol conversion, electrical conversion, optical conversion, accesscontrol, user identification, user information retrieval, trafficmonitoring, statistics generation, configuration, management, and/orsource name determination.

The access module 80 receives the data object 40 and creates a series ofdata segments 1 through Y 90-92 in accordance with a data storageprotocol (e.g., file storage system, a block storage system, and/or anaggregated block storage system). The number of segments Y may be chosenor randomly assigned based on a selected segment size and the size ofthe data object. For example, if the number of segments is chosen to bea fixed number, then the size of the segments varies as a function ofthe size of the data object. For instance, if the data object is animage file of 4,194,304 eight bit bytes (e.g., 33,554,432 bits) and thenumber of segments Y=131,072, then each segment is 256 bits or 32 bytes.As another example, if segment sized is fixed, then the number ofsegments Y varies based on the size of data object. For instance, if thedata object is an image file of 4,194,304 bytes and the fixed size ofeach segment is 4,096 bytes, the then number of segments Y=1,024. Notethat each segment is associated with the same source name.

The grid module 82 receives the data segments and may manipulate (e.g.,compression, encryption, cyclic redundancy check (CRC), etc.) each ofthe data segments before performing an error coding function of theerror coding dispersal storage function to produce a pre-manipulateddata segment. After manipulating a data segment, if applicable, the gridmodule 82 error encodes (e.g., Reed-Solomon, Convolution encoding,Trellis encoding, etc.) the data segment or manipulated data segmentinto X error coded data slices 42-44.

The value X, or the number of pillars (e.g., X=16), is chosen as aparameter of the error coding dispersal storage function. Otherparameters of the error coding dispersal function include a readthreshold T, a write threshold W, etc. The read threshold (e.g., T=10,when X=16) corresponds to the minimum number of error-free error codeddata slices required to reconstruct the data segment. In other words,the DS processing module 34 can compensate for X-T (e.g., 16−10=6)missing error coded data slices per data segment. The write threshold Wcorresponds to a minimum number of DS storage units that acknowledgeproper storage of their respective data slices before the DS processingmodule indicates proper storage of the encoded data segment. Note thatthe write threshold is greater than or equal to the read threshold for agiven number of pillars (X).

For each data slice of a data segment, the grid module 82 generates aunique slice name 37 and attaches it thereto. The slice name 37 includesa universal routing information field and a vault specific field and maybe 48 bytes (e.g., 24 bytes for each of the universal routinginformation field and the vault specific field). As illustrated, theuniversal routing information field includes a slice index, a vault ID,a vault generation, and a reserved field. The slice index is based onthe pillar number and the vault ID and, as such, is unique for eachpillar (e.g., slices of the same pillar for the same vault for anysegment will share the same slice index). The vault specific fieldincludes a data name, which includes a file ID and a segment number(e.g., a sequential numbering of data segments 1-Y of a simple dataobject or a data block number).

Prior to outputting the error coded data slices of a data segment, thegrid module may perform post-slice manipulation on the slices. Ifenabled, the manipulation includes slice level compression, encryption,CRC, addressing, tagging, and/or other manipulation to improve theeffectiveness of the computing system.

When the error coded data slices of a data segment are ready to beoutputted, the grid module 82 determines which of the DS storage units36 will store the EC data slices based on a dispersed storage memorymapping associated with the user's vault and/or DS storage unitattributes. The DS storage unit attributes may include availability,self-selection, performance history, link speed, link latency,ownership, available DSN memory, domain, cost, a prioritization scheme,a centralized selection message from another source, a lookup table,data ownership, and/or any other factor to optimize the operation of thecomputing system. Note that the number of DS storage units 36 is equalto or greater than the number of pillars (e.g., X) so that no more thanone error coded data slice of the same data segment is stored on thesame DS storage unit 36. Further note that EC data slices of the samepillar number but of different segments (e.g., EC data slice 1 of datasegment 1 and EC data slice 1 of data segment 2) may be stored on thesame or different DS storage units 36.

The storage module 84 performs an integrity check on the outboundencoded data slices and, when successful, identifies a plurality of DSstorage units based on information provided by the grid module 82. Thestorage module 84 then outputs the encoded data slices 1 through X ofeach segment 1 through Y to the DS storage units 36. Each of the DSstorage units 36 stores its EC data slice(s) and maintains a localvirtual DSN address to physical location table to convert the virtualDSN address of the EC data slice(s) into physical storage addresses.

In an example of a read operation, the user device 12 and/or 14 sends aread request to the DS processing unit 14, which authenticates therequest. When the request is authentic, the DS processing unit 14 sendsa read message to each of the DS storage units 36 storing slices of thedata object being read. The slices are received via the DSnet interface32 and processed by the storage module 84, which performs a parity checkand provides the slices to the grid module 82 when the parity check wassuccessful. The grid module 82 decodes the slices in accordance with theerror coding dispersal storage function to reconstruct the data segment.The access module 80 reconstructs the data object from the data segmentsand the gateway module 78 formats the data object for transmission tothe user device.

FIG. 4 is a schematic block diagram of an embodiment of a grid module 82that includes a control unit 73, a pre-slice manipulator 75, an encoder77, a slicer 79, a post-slice manipulator 81, a pre-slice de-manipulator83, a decoder 85, a de-slicer 87, and/or a post-slice de-manipulator 89.Note that the control unit 73 may be partially or completely external tothe grid module 82. For example, the control unit 73 may be part of thecomputing core at a remote location, part of a user device, part of theDS managing unit 18, or distributed amongst one or more DS storageunits.

In an example of write operation, the pre-slice manipulator 75 receivesa data segment 90-92 and a write instruction from an authorized userdevice. The pre-slice manipulator 75 determines if pre-manipulation ofthe data segment 90-92 is required and, if so, what type. The pre-slicemanipulator 75 may make the determination independently or based oninstructions from the control unit 73, where the determination is basedon a computing system-wide predetermination, a table lookup, vaultparameters associated with the user identification, the type of data,security requirements, available DSN memory, performance requirements,and/or other metadata.

Once a positive determination is made, the pre-slice manipulator 75manipulates the data segment 90-92 in accordance with the type ofmanipulation. For example, the type of manipulation may be compression(e.g., Lempel-Ziv-Welch, Huffman, Golomb, fractal, wavelet, etc.),signatures (e.g., Digital Signature Algorithm (DSA), Elliptic Curve DSA,Secure Hash Algorithm, etc.), watermarking, tagging, encryption (e.g.,Data Encryption Standard, Advanced Encryption Standard, etc.), addingmetadata (e.g., time/date stamping, user information, file type, etc.),cyclic redundancy check (e.g., CRC32), and/or other data manipulationsto produce the pre-manipulated data segment.

The encoder 77 encodes the pre-manipulated data segment 92 using aforward error correction (FEC) encoder (and/or other type of erasurecoding and/or error coding) to produce an encoded data segment 94. Theencoder 77 determines which forward error correction algorithm to usebased on a predetermination associated with the user's vault, a timebased algorithm, user direction, DS managing unit direction, controlunit direction, as a function of the data type, as a function of thedata segment 92 metadata, and/or any other factor to determine algorithmtype. The forward error correction algorithm may be Golay,Multidimensional parity, Reed-Solomon, Hamming, Bose Ray ChauduriHocquenghem (BCH), Cauchy-Reed-Solomon, or any other FEC encoder. Notethat the encoder 77 may use a different encoding algorithm for each datasegment 92, the same encoding algorithm for the data segments 92 of adata object, or a combination thereof.

The encoded data segment 94 is of greater size than the data segment 92by the overhead rate of the encoding algorithm by a factor of X/T, whereX is the width or number of slices, and T is the read threshold. In thisregard, the corresponding decoding process can accommodate at most X-Tmissing EC data slices and still recreate the data segment 92. Forexample, if X=16 and T=10, then the data segment 92 will be recoverableas long as 10 or more EC data slices per segment are not corrupted.

The slicer 79 transforms the encoded data segment 94 into EC data slicesin accordance with the slicing parameter from the vault for this userand/or data segment 92. For example, if the slicing parameter is X=16,then the slicer 79 slices each encoded data segment 94 into 16 encodedslices.

The post-slice manipulator 81 performs, if enabled, post-manipulation onthe encoded slices to produce the EC data slices. If enabled, thepost-slice manipulator 81 determines the type of post-manipulation,which may be based on a computing system-wide predetermination,parameters in the vault for this user, a table lookup, the useridentification, the type of data, security requirements, available DSNmemory, performance requirements, control unit directed, and/or othermetadata. Note that the type of post-slice manipulation may includeslice level compression, signatures, encryption, CRC, addressing,watermarking, tagging, adding metadata, and/or other manipulation toimprove the effectiveness of the computing system.

In an example of a read operation, the post-slice de-manipulator 89receives at least a read threshold number of EC data slices and performsthe inverse function of the post-slice manipulator 81 to produce aplurality of encoded slices. The de-slicer 87 de-slices the encodedslices to produce an encoded data segment 94. The decoder 85 performsthe inverse function of the encoder 77 to recapture the data segment90-92. The pre-slice de-manipulator 83 performs the inverse function ofthe pre-slice manipulator 75 to recapture the data segment 90-92.

FIG. 5 is a diagram of an example of slicing an encoded data segment 94by the slicer 79. In this example, the encoded data segment 94 includesthirty-two bits, bytes, data words, etc., but may include more or lessbits, bytes, data words, etc. The slicer 79 disperses the bits of theencoded data segment 94 across the EC data slices in a pattern as shown.As such, each EC data slice does not include consecutive bits, bytes,data words, etc. of the data segment 94 reducing the impact ofconsecutive bit, byte, data word, etc. failures on data recovery. Forexample, if EC data slice 2 (which includes bits 1, 5, 9, 13, 17, 25,and 29) is unavailable (e.g., lost, inaccessible, or corrupted), thedata segment can be reconstructed from the other EC data slices (e.g.,1, 3 and 4 for a read threshold of 3 and a width of 4).

FIG. 6A is a schematic block diagram of another embodiment of acomputing system that includes a computing device 102 and a dispersedstorage network (DSN) memory 22. The DSN memory 22 includes a pluralityof storage nodes 106. Each storage node 106 of the plurality of storagenodes 106 may be implemented utilizing at least one of a dispersedstorage (DS) unit, a storage server, a DS processing unit, and a userdevice. The computing device 102 includes a DS module 108. The DS module108 includes a receive module 110, a select module 112, a generatemodule 114, and an output module 116.

The receive module 110 receives a request to copy a data object 118. Thedata object is stored in the DSN number 22 as a one or more sets ofencoded data slices based on a dispersed storage error coding function.The request to copy 118 includes at least one of a snapshot request(e.g., to document a copy of the data object), a component of aduplication request (e.g., to store same data without replication toaffect de-duplication), and a component of a backup request. The backuprequest may include an initial phase of a backup process. The backupprocess may include increasing a pillar width parameter of the dispersedstorage error coding function to add additional encoded data sliceswhile producing the non-replicated copy of the data object.

In response to the request to copy the data object, the select module112 identifies one or more sets of at least a decode threshold number ofslice names 120 for the one or more sets of encoded data slices. Forexample, the select module 112 extracts a data identifier from therequest to copy the data object. The select module 112 accesses adirectory utilizing the data identifier to identify the one or more setsof at least a decode threshold number of slice names 120 (e.g.,identifying a source name and determining the slice names based on thesource name).

The generate module 114 generates one or more sets of at least a decodethreshold of new slice names 122 for the one or more sets of encodeddata slices. The generate module 114 generates the one or more sets ofat least a decode threshold of new slice names 122 by generating the oneor more sets of at least a decode threshold of new slice names 122 inaccordance with the dispersed storage error coding function. The one ormore sets of at least a decode threshold of new slice names 122 mayinclude several identical values for fields as the one or more sets ofat least a decode threshold number of slice names. For example, theidentical values for fields including a pillar index field, a segmentnumber field, and a vault ID field. The one or more sets of at least adecode threshold of new slice names 122 includes non-identical valuesfor other fields including an object number field. The object numberfield may be generated based on one or more of a random number, a fixedoffset, and a deterministic value of an element associated with the copy(e.g., a hashing function value of a snapshot number).

Alternatively, or in addition to, the generate module 114 generates theone or more sets of at least a decode threshold of new slice names 122by sending a request to generate the one or more sets of new slicesnames 124 to the storage nodes 106. In response, a first storage node106 of the storage nodes 106 generates a first slice name (e.g., of afirst pillar associated with the first storage node 106) for each of theone or more sets of at least a decode threshold of new slice names 122in accordance with the dispersed storage error coding function. A secondstorage node 106 of the storage nodes 106 generates a second slice name(e.g., of a second pillar associated with the second storage node 106)for each of the one or more set of at least a decode threshold of newslice names 122 in accordance with the dispersed storage error codingfunction.

The output module 116 sends the one or more sets of at least a decodethreshold of new slice names 122 to storage nodes of the DSN for storagetherein. The output module 116 instructs the storage nodes 106 to linkthe one or more sets of at least a decode threshold of new slice names122 to the one or more sets of encoded data slices thereby producing anon-replicated copy of the data object. The output module 116 sends alink request 126 to the storage nodes 106 to perform the linking. Thelink request 126 includes one or more of the one or more sets of atleast a decode threshold of new slice names 122, the one or more sets ofat least a decode threshold of slice names 120, and a clone requestopcode.

The output module 116 instructs to link by instructing the first storagenode 106 of the storage nodes 106 to update a first slice location tableto link a first new slice name of the one or more sets of at least adecode threshold of new slice names 122 to a first slice name of the oneor more sets of at least a decode threshold of slice names 120 for afirst encoded data slice of the one or more sets of encoded data slices.The output module 116 instructs a second storage node 106 of the storagenodes 106 to update a second slice location table to link a second newslice name of the one or more sets of at least a decode threshold of newslice names 122 to a second slice name of the one or more sets of atleast a decode threshold of slice names 120 for a second encoded dataslice of the one or more sets of encoded data slices.

FIG. 6B is a flowchart illustrating an example of copying data. Themethod begins at step 130 where a processing module (e.g., of adispersed storage (DS) processing unit) receives a request to copy adata object. The data object is stored in a dispersed storage network(DSN) as a one or more sets of encoded data slices based on a dispersedstorage error coding function. The request to copy includes at least oneof a snapshot request, a component of a duplication request, a dataidentifier, and a component of a backup request. In response to therequest to copy the data object, the method continues at step 132 wherethe processing module identifies one or more sets of at least a decodethreshold number of slice names for the one or more sets of encoded dataslices (e.g., a directory lookup based on the data identifier of therequest).

The method continues at step 134 where the processing module generatesone or more sets of at least a decode threshold of new slice names forthe one or more sets of encoded data slices. The generating the one ormore sets of at least a decode threshold of new slice names includesgenerating the one or more sets of at least a decode threshold of newslice names in accordance with the dispersed storage error codingfunction. Alternatively, or in addition to, the generating the one ormore sets of at least a decode threshold of new slice names includessending a request to generate the one or more sets of new slices namesto the storage nodes. A first storage node of the storage nodesgenerates a first slice name for each of the one or more sets of atleast a decode threshold of new slice names in accordance with thedispersed storage error coding function. A second storage node of thestorage nodes generates a second slice name for each of the one or moreset of at least a decode threshold of new slice names in accordance withthe dispersed storage error coding function.

The method continues at step 136 where the processing module sends theone or more sets of at least a decode threshold of new slice names tostorage nodes of the DSN for storage therein. The method continues atstep 138 where the processing module instructs the storage nodes to linkthe one or more sets of at least a decode threshold of new slice namesto the one or more sets of encoded data slices thereby producing anon-replicated copy of the data object. For example, the processingmodule generates and sends a clone request to the storage nodes. Theinstructing to link includes instructing a first storage node of thestorage nodes updating a first slice location table to link a first newslice name of the one or more sets of at least a decode threshold of newslice names to a first slice name of the one or more sets of at least adecode threshold of slice names for a first encoded data slice of theone or more sets of encoded data slices. The instructing to link furtherincludes instructing a second storage node of the storage nodes updatinga second slice location table to link a second new slice name of the oneor more sets of at least a decode threshold of new slice names to asecond slice name of the one or more sets of at least a decode thresholdof slice names for a second encoded data slice of the one or more setsof encoded data slices.

FIG. 6C is a diagram of a slice location table structure 140 thatincludes a slice name field 142, a cloned indicator field 144, and alocation field 146. The slice name field 142 includes a plurality ofslice name entries, wherein the slice name entries corresponds to aplurality of encoded data slices stored in a dispersed storage network(DSN) memory. The cloned indicator field 144 includes a plurality ofcloned indicator entries, wherein the cloned indicator entriescorresponds to the plurality of encoded data slices. Each clonedindicator entry indicates whether a corresponding encoded data slice iscloned (e.g., copied without replication) or not cloned. For example,the cloned indicator entry indicates yes to indicate that thecorresponding encoded data slice is cloned and indicates no to indicatethat the corresponding encoded data slice is not cloned. The locationfield 146 includes a plurality of location entries, wherein the locationentries corresponds to one or more DSN memory storage locations of theplurality of encoded data slices. The DSN memory storage location mayinclude one or more of a dispersed storage (DS) unit identifier (ID), amemory ID, an absolute memory address, and a memory address offset.

Encoded data slices that are different may be stored at differentlocations. For example, an encoded data slice corresponding to slicename DC56 is not cloned and is stored at location A836 and anotherencoded data slice corresponding to slice name DC60 is cloned with otherencoded data slices and is stored at location D341. Encoded data slicesthat are the same may be stored at the same location to provide astorage efficiency improvement. For example, the encoded data slicecorresponding to slice name DC60 is cloned with other encoded dataslices and is stored at location D341, encoded data slice correspondingto slice name DC61 is cloned with other encoded data slices and is alsostored at location D341. As such, one copy of encoded data slices storedat location D341 and two different slice names point to the same encodeddata slice. An encoded data slice may be cloned any number of times. Assuch, any number of slice names may point to an encoded data slicestored at the same location. For example, slice names DC70, DC78, DC89point a cloned encoded data slice stored at location 3B5.

An encoded data slice may be cloned to provide a snapshot of a revisionof data being stored and/or for the data being stored at a particulartime. For example, a first encoded data slice is stored in the DSNmemory at location 1 at time=t1 utilizing slice name A and indicatingnot cloned. A snapshot of the encoded data slice is provided at time t=2by cloning the encoded data slice adding slice name B to the slicelocation table pointing to location 1 and indicating cloned. Inaddition, the slice location table is updated such that slice name Aalso indicates cloned and is still pointing to location 1. Next, theencoded data slice is updated for slice name A and stored at a location2. The slice location table is updated such that slice name A points tolocation 2 and indicates not cloned and slice name B still points tolocation 1 and indicates not cloned.

FIG. 6D is a flowchart illustrating an example of cloning a slice. Themethod begins at step 148 where a processing module (e.g., of adispersed storage (DS) unit) receives a clone slice request and/or alink request. The request includes one or more of a slice name, a startslice name, an end slice name, a slice name field wildcard indicator, asource name, and a new slice name indicator (e.g., increment, absolutenumber).

The method continues at step 150 where the processing module identifiesan old slice name that corresponds to the request. The identification isbased on one or more of the request and a slice location table lookup.For example, the processing module matches a slice name of the requestto a slice name of the slice location table to identify the old slicename.

The method continues at step 152 where the processing module generates anew slice name. The generation is based on one or more of acorresponding old slice name and the new slice name indicator. Forexample, the processing module adds a slice name offset increment to theold slice name to produce the new slice name when the new slice nameindicator includes the slice name offset increment. As another example,the processing module utilizes an absolute number of the new slice nameindicator as the new slice name.

The method continues at step 154 where the processing module modifiesthe slice location table to add the new slice name. The modificationincludes one or more of adding a new entry that includes the new slicename, a cloned indicator entry to indicate cloned, and a slice locationentry that corresponds to a slice location of an encoded data slice ofthe old slice name. Alternatively, the new entry includes a pointer fromthe new slice name to the old slice name. A cloned entry associated withthe old slice name is updated to indicate cloned when the indicatorindicates not cloned (e.g., first cloning).

FIG. 6E is a schematic block diagram of another embodiment of acomputing system that includes a computing device 160 and a dispersedstorage network (DSN) memory 22. The DSN memory 22 includes a pluralityof storage nodes 106. Each storage node 106 of the plurality of storagenodes 106 may be implemented utilizing at least one of a dispersedstorage (DS) unit, a storage server, a DS processing unit, and a userdevice. The computing device 160 includes a DS module 162. The DS module162 includes a receive module 164, a select module 166, and an outputmodule 168.

The receive module 164 receives a request 170 to update a data object.The data object is stored in the DSN memory 22 as a one or more sets ofencoded data slices based on a dispersed storage error coding function.The one or more sets of encoded data slices are identified by a firstone or more sets of at least a decode threshold of slice names and asecond one or more sets of at least a decode threshold of slice names.The request 170 to update the data object includes an updated dataobject, a data identifier, and one or more of a source name associatedwith the data object, slice names associated with the data object, and acloned indicator.

The select module 166 selects the first or the second one or more setsof at least a decode threshold of slice names for the update to the dataobject to produce a selected one or more sets of at least a decodethreshold of slice names 172. The select module 166 selects the first orthe second one or more sets of at least a decode threshold of slicenames by at least one of a variety of approaches. A first approachincludes selecting the first or the second one or more sets of at leasta decode threshold of slice names based on the request for updating(e.g., request includes appropriate slice names). A second approachincludes selecting the first or the second one or more sets of at leasta decode threshold of slice names based on chronological creation of thefirst and the second one or more sets of at least a decode threshold ofslice names (e.g., update oldest). A third approach includes selectingthe first or the second one or more sets of at least a decode thresholdof slice names based on a snapshot procedure (e.g., receive a snapshotrequest).

The output module 168 sends one or more sets of updated encoded dataslices regarding the update to the data object to storage nodes 106 ofthe DSN memory 22. The storage nodes 106 store the one or more sets ofupdated encoded data slices in new storage locations addressable basedon the selected one or more sets of at least a decode threshold of slicenames 172. The output module 168 generates the one or more sets ofupdated encoded data slices regarding the update to the data object inaccordance with the dispersed storage error coding function. The sendingincludes the output module 168 sending write requests 174 to the storagenodes for storing the one or more sets of updated encoded data slices.

The output module 168 instructs the storage nodes to unlink the selectedone or more sets of at least a decode threshold of slice names from theone or more sets of encoded data slices (e.g., to indicate not cloned).For example, the output module 168 generates and sends an unlink request178 to the storage nodes. The output module 168 instructs the unlinkingby instructing a first storage node of the storage nodes updating afirst slice location table to unlink a first slice name of the first oneor more sets of at least a decode threshold of slice names from a firstslice name of the second one or more sets of at least a decode thresholdof slice names for a first encoded data slice of the one or more sets ofencoded data slices. The output module 168 further instructs theunlinking by instructing a second storage node of the storage nodesupdating a second slice location table to unlink a second slice name ofthe first one or more sets of at least a decode threshold of new slicenames from a second slice name of the second one or more sets of atleast a decode threshold of slice names for a second encoded data sliceof the one or more sets of encoded data slices.

FIG. 6F is a flowchart illustrating an example of updating data. Themethod begins with step 180 where a processing module (e.g., of adispersed storage (DS) processing unit) receives a request to update adata object. The data object is stored in a dispersed storage network(DSN) as a one or more sets of encoded data slices based on a dispersedstorage error coding function. The one or more sets of encoded dataslices are identified by a first one or more sets of at least a decodethreshold of slice names and a second one or more sets of at least adecode threshold of slice names (e.g., two or more sets of slice namespoint to the same data when the data is cloned without replication).

The method continues at step 182 where the processing module selects thefirst or the second one or more sets of at least a decode threshold ofslice names for the update to the data object to produce a selected oneor more sets of at least a decode threshold of slice names. Theselecting the first or the second one or more sets of at least a decodethreshold of slice names includes at least one of a variety ofapproaches. A first approach includes selecting the first or the secondone or more sets of at least a decode threshold of slice names based onthe request for updating (e.g., request includes appropriate slicenames). A second approach includes selecting the first or the second oneor more sets of at least a decode threshold of slice names based onchronological creation of the first and the second one or more sets ofat least a decode threshold of slice names (e.g., update oldest). Athird approach includes selecting the first or the second one or moresets of at least a decode threshold of slice names based on a snapshotprocedure. (e.g., receive a snapshot request).

The method continues at step 184 where the processing module generatesone or more sets of updated encoded data slices regarding the update tothe data object in accordance with a dispersed storage error codingfunction. For example, the processing module encodes the updated dataobject utilizing the dispersed storage error coding function to producethe one or more sets of updated encoded data slices. The methodcontinues at step 186 where the processing module sends the one or moresets of updated encoded data slices regarding the update to the dataobject to storage nodes of the DSN. The sending includes generating andsending write requests to the storage nodes for storing the one or moresets of updated encoded data slices. The write requests includes the oneor more sets of updated encoded data slices. The storage nodes store theone or more sets of updated encoded data slices in new storage locationsaddressable based on the selected one or more sets of at least a decodethreshold of slice names.

The method continues at step 188 where the processing module instructsthe storage nodes to unlink the selected one or more sets of at least adecode threshold of slice names from the one or more sets of encodeddata slices (e.g., to indicate not cloned). The instructing me includegenerating and outputting an unlink request to the storage nodes. Theinstructing the unlinking includes instructing a first storage node ofthe storage nodes updating a first slice location table to unlink afirst slice name of the first one or more sets of at least a decodethreshold of slice names from a first slice name of the second one ormore sets of at least a decode threshold of slice names for a firstencoded data slice of the one or more sets of encoded data slices. Theinstructing the unlinking further includes instructing a second storagenode of the storage nodes updating a second slice location table tounlink a second slice name of the first one or more sets of at least adecode threshold of new slice names from a second slice name of thesecond one or more sets of at least a decode threshold of slice namesfor a second encoded data slice of the one or more sets of encoded dataslices.

FIG. 6G is a diagram of another slice location table 140 that includes aslice name field 142, a cloned indicator field 144, and a location field146. The slice location table of FIG. 6C is updated to produce the slicelocation table of FIG. 6G. The update may result from decloning anencoded data slice when two slice names point to a common encoded dataslice. In addition, the update may result from decloning another encodeddata slice when three or more slice names point to a second commonencoded data slice.

As an example when the slice location table 140 is updated as a resultof decloning an encoded data slice when two slice names point to thecommon encoded data slice, slice names DC60 and DC61 pointed to a commonencoded data slice stored at location D341 as depicted in FIG. 6A. Slicelocation table entries associated with slice names DC60 and DC61indicated that the slices were cloned. Next, the encoded data sliceassociated with slice name DC60 is updated and stored at a new slicestorage location address of D342. The slice location table entryassociated with slice name DC60 is updated to indicate not cloned andpointing to storage location D342. The slice location entry associatedwith slice name DC61 is updated to indicate not cloned and is stillpointing to storage location D341 (e.g., thus maintaining an originalsnapshot).

As an example when the slice location table 140 is updated as a resultof decloning an encoded data slice when three or more slice names pointto another common encoded data slice, slice names DC70, DC78, and DC89pointed to another common encoded data slice stored at location 3B5 asdepicted in FIG. 6C. Slice location table entries associated with slicenames DC70, DC78, and DC89 indicated that the slices were cloned. Next,the encoded data slice associated with slice name DC78 is updated andstored at a new slice storage location address of 3B6. The slicelocation table entry associated with slice name DC78 is updated toindicate not cloned and pointing to storage location 3B6. The two aremore slice location entries associated with slice names DC70 and DC89are not updated and still indicate cloned pointing to storage location3B5 (e.g., thus maintaining two or more snapshots).

FIG. 6H is a flowchart illustrating an example of updating a slice. Themethod begins at step 190 where a processing module (e.g., of adispersed storage (DS) unit) receives an update slice request. Therequest includes one or more of a slice name, a source name, and a newencoded data slice. The method continues at step 192 where theprocessing module determines whether the slice name of the request isassociated with a cloned slice. The determination may be based onaccessing an entry of a slice location table corresponding to the slicename and extracting a cloned entry of a cloned field. The processingmodule determines that the slice name of the request is associated withthe cloned slice when the cloned entry indicates that an associatedencoded data slice is cloned. The method branches to step 196 when theprocessing module determines that the slice name of the request isassociated with the cloned slice. The method continues to step 194 whenthe processing module determines that the slice name of the request isnot associated with the cloned slice. The method continues at step 194where the processing module updates the encoded data slice. The updatingincludes one or more of storing the new encoded slice to a new memorystorage location and storing the new encoded data slice to an existingmemory storage location associated with the encoded data slice (e.g., tooverwrite the encoded data slice with the new encoded data slice). Theprocessing module updates the storage location table to indicate the newmemory storage location is associated with the slice name when the newmemory storage location is utilized.

The method continues at step 196 where the processing module stores thenew encoded data slice of the request at the new memory storage locationwhen the processing module determines that the slice name of the requestis associated with the cloned slice. For example, the processing modulestores the new encoded data slice at the new memory storage location andupdates the storage location table to indicate the new memory storagelocation is associated with the slice name. The method continues at step198 where the processing module determines cloned indicatormodifications. For example, the processing module determines that thecloned indicator modifications includes an indication that the slicename associated with the new encoded data slice is not cloned. Asanother example, the processing module determines that the clonedindicator modifications includes an indication that a slice nameassociated with the cloned slice is not cloned when no other slice namesare associated with the cloned slice. The method continues at step 200where the processing module modifies the slice location table inaccordance with the cloned indicator modifications.

FIG. 7A is a schematic block diagram of another embodiment of acomputing system that includes a dispersed storage (DS) processing unit16 and a set of DS units 1-6. A first step of a data update scenarioincludes the DS processing unit 16 generating and storing data as data1-4 and generates and stores parity of the data as parity 5-6 in DSunits 1-6. The generating of data 1-4 and parity 5-6 is in accordancewith a data encoding function. The data encoding function includesutilizing an encoding matrix. The encoding matrix may be associated witha systematic erasure code and may include a unity square matrix (e.g., afirst decode threshold number of rows each includes a one in a singlecolumn of a decode threshold number of columns producing a diagonalstring of one's) and includes a width number minus the decode thresholdnumber of parity rows (e.g., a Vandermonde matrix). The parity rowsincludes encoding matrix entries in accordance with the data encodingfunction.

The generation of data 1-4 and parity 5-6 includes matrix multiplyingthe encoding matrix by the data to produce a width number of encodeddata slices. The encoded data slices 1-4 produce data 1-4 and encodeddata slices 5-6 produce parity 5-6. The storing of the data includessending data 1 to DS unit 1 for storage therein, sending data 2 to DSunit 2 for storage therein, sending data 3 to DS unit 3 for storagetherein, sending data 4 to DS unit 4 for storage therein, sending parity5 to DS unit 5 for storage therein, and sending parity 6 to DS unit 6for storage therein.

FIG. 7B is a schematic block diagram of another embodiment of acomputing system that includes a dispersed storage (DS) processing unit16 and a set of DS units 1-6. A second step of a data update scenarioincludes the DS processing unit 16 obtaining an updated portion of datato produce updated data and sending an updated data storage requestmessage to a corresponding DS unit to replace a corresponding portion ofthe data. The obtaining may include receiving the updated portion ofdata, receiving data that includes the updated portion of data, andanalyzing data to detect the updated portion of data. The storagerequest message may include one or more of the updated data, encodinginformation, and a request for delta parity information. The encodinginformation may include one or more of an encoding matrix, a width, anda decode threshold. For example, the DS processing unit 16 receives anupdated portion of data corresponding to a second portion of data toproduce updated data 2 (e.g., slice 2) and sends a storage requestmessage to DS unit 2 that includes the updated data 2.

FIG. 7C is a schematic block diagram of another embodiment of acomputing system that includes a dispersed storage (DS) processing unit16 and a set of DS units 1-6. A third step of a data update scenarioincludes the DS processing unit 16 generating delta parity informationbased on updated data, data (e.g., previous data which is being replacedby the updated data) and an encoding function, and sending the deltaparity information to a corresponding DS processing unit 16.Alternatively, the DS unit sends the delta parity information directlyto one or more other DS units associated with storage of parityinformation. For example, DS unit 2 generates the delta parityinformation to include delta parity 5 and delta parity 6 based onupdated data 2, data 2, and the encoding function and sends the deltaparity information to the DS processing unit 16. For instance, DS unit 2generates the delta parity information in accordance with formulas deltaparity 5=rebuilt partial (for parity 5 based on updated data 2) XORrebuilt partial (for parity 5 based on data 2) and delta parity6=rebuilt partial (for parity 6 based on updated data 2) XOR rebuiltpartial (for parity 6 based on data 2) and sends the delta parityinformation to a corresponding DS processing unit 16. The DS unit 2generates such a rebuilt partial (for parity 5 based on updated data 2)by multiplying an inverted square matrix of a unity matrix of anencoding matrix of the encoding function by a data matrix including theupdated data 2 by a row of the encoding matrix corresponding to parity5.

FIG. 7D is a schematic block diagram of another embodiment of acomputing system that includes a dispersed storage (DS) processing unit16 and a set of DS units 1-6. A fourth step of a data update scenarioincludes the DS processing unit 16 outputting one or more exclusive OR(XOR) requests to one or more DS units associated with storing parityinformation. The XOR requests includes delta parity information and aparity slice identifier, each of the one or more DS units generates andstores updated parity information based on the delta parity information,stored parity information, and encoding information. For example, the DSprocessing unit 16 sends an XOR request that includes delta parity 5 toDS unit 5 and sends an XOR request that includes delta parity 6 to DSunit 6. DS unit 5 retrieves parity 5 (e.g., from a local DS unit 5memory), wherein parity 5 is associated with updated parity 5. DS unit 5generates updated parity 5 in accordance with a formula updated parity5=parity 5 XOR delta parity 5. DS unit 5 stores updated parity 5 (e.g.,in the local memory), replacing parity 5. DS unit 6 retrieves parity 6(e.g., from a local DS unit 6 memory). The parity 6 is associated withupdated parity 6. DS unit 6 generates updated parity 6 in accordancewith a formula updated parity 6=parity 6 XOR delta parity 6. DS unit 6stores updated parity 6 (e.g., in the local DS unit 6 memory), replacingparity 6.

FIG. 7E is a flowchart illustrating an example of updating data storage.The method begins at step 202 where a processing module (e.g., of adispersed storage (DS) processing unit) sends an update data slicerequest to a corresponding data DS unit. An updated data slice of therequest is associated with a previously stored encoded data slice of aset of stored encoded data slices. The method continues at step 204where the processing module receives delta parity information (e.g.,from the corresponding data DS unit). The method continues at step 206where the processing module sends the delta parity information to one ormore parity DS units. The one or more parity DS units are associatedwith the storage of parity information associated with the set of storedencoded data slices.

FIG. 7F is a flowchart illustrating an example of storing updated data.The method begins at step 208 where a processing module (e.g., of adispersed storage (DS) unit) receives an update data slice (e.g.,updated data) request corresponding to a previously stored encoded dataslice (e.g., data). The method continues at step 210 where theprocessing module retrieves the previously stored encoded data slicefrom a memory (e.g., associated with the data DS unit). The methodcontinues at step 212 where the processing module generates delta parityinformation based on an updated encoded data slice of the request andthe previously stored encoded data slice. For example, the processingmodule generates the delta parity information in accordance withformulas delta parity 5=rebuilt partial (for parity slice 5 based onupdated data slice 2) exclusive OR (XOR) rebuilt partial (for parityslice 5 based on data slice 2) and delta parity 6=rebuilt partial (forparity slice 6 based on updated data slice 2) XOR rebuilt partial (forparity slice 6 based on data slice 2) when the delta parity informationincludes two parity slices.

The method continues at step 214 where the processing module stores theupdated encoded data slice. Alternatively, or in addition to, theprocessing module replaces the encoded data slice with the updated dataslice and/or deletes the data slice. The method continues at step 216where the processing module outputs the delta parity information (e.g.,to a corresponding DS processing unit associated with sending theupdated data slice).

FIG. 7G is a flowchart illustrating an example of generating an updatedparity slice. The method begins at step 218 where a processing module(e.g., of a parity dispersed storage (DS) unit) receives an exclusive OR(XOR) request that includes delta parity information and a parity slicename corresponding to a stored parity slice. The method continues atstep 220 where the processing module retrieves the stored parity slice(e.g., from a local memory of the parity DS unit). The method continuesat step 222 where the processing module generates an updated parityslice based on the delta parity information and the stored parity slice.For example, the processing module generates the updated parity slice inaccordance with a formula updated parity slice 5=parity slice 5 XORdelta parity slice 5 when the DS unit is DS unit 5. The method continuesat step 224 where the processing module stores the updated parity slice.Alternatively, or in addition to, the processing module replaces theparity slice with the updated data slice and/or deletes the parityslice.

FIG. 8A is a diagram illustrating an example of a directory structure218 that includes a file name field 220, a metadata field 222, and aslice location field 224. The slice location field 224 includes asegment number field 226 and a location information field 228. Thedirectory 218 includes a plurality of entries. Each entry of theplurality of entries is associated with a filename entry in the filename field 220. Each filename entry describes a user file system filename (e.g., a file name, and object name, a block number) of anassociated file stored as a plurality of sets of encoded data slices ina dispersed storage network (DSN) memory. Each set of encoded dataslices corresponds to a data segment of a plurality of data segments ofdata of the associated file.

The entry includes a metadata entry of the metadata field 222. Eachmetadata entry corresponds to a filename of the plurality of filenames.Each metadata entry may include one or more metadata values. Themetadata values may include values associated with one or more of a datasize indicator, a data type indicator, a creation date, an owneridentifier (ID), permissions, a delete date, and storage requirements.For example, metadata associated with filename clip.mpg includes a datasize indicator of 500 megabytes and a data type indicator of a videofile. Alternatively, a plurality of metadata entries may correspond to aplurality of data segments of the data.

The entry includes one or more segment number entries in the segmentnumber field 226. Each segment number entry corresponds to a filenameand includes at least one of a segment number and a block number. Forexample, segment numbers 1-3 correspond to three data segments includedin data of filename foo.doc and segment numbers 1-4 correspond to fordata segments included in data of filename clip.mpg.

The entry includes one or more location entries in the locationinformation field 228. Each location information entry includes locationinformation associated with storage of a set of encoded data slicesassociated with a corresponding data segment. Each data segment may bestored in the DSN memory at a different location. The locationinformation includes one or more of a set of dispersed storage (DS) unitidentifiers (IDs), a set of internet protocol (IP) addressescorresponding to the set of DS units, a hostname, a site name, and a setof slice names corresponding to the set of encoded data slices. Forexample, a set of encoded data slices associated with data segment 2 offoo.doc is stored at DS units 17-32.

FIG. 8B is a flowchart illustrating an example of storing data. Themethod begins at step 232 where processing module (e.g., of a dispersedstorage (DS) processing module) dispersed storage error encodes a datasegment to produce a set of encoded data slices. The method continues atstep 234 where the processing module identifies candidate DS units. Theidentifying may be based on one or more of a previously utilized DS unitidentifier (ID), a DS unit list, and DS unit availability information.For example, the processing module identifies the candidate DS units toinclude DS units that are currently online and operational (e.g.,available).

The method continues at step 236 where the processing module determinesstorage requirements. The determining may be based on one or more ofmetadata associated with the data segment which includes at least one ofa storage requirement, a query to a requesting entity, a vaultidentifier (ID), a requirements lookup based on the vault ID, andreceiving the storage requirements.

The method continues at step 238 where the processing module selects aset of DS units of the candidate DS units based on the storagerequirements. The selecting may be based on one or more of a preferredDS unit list, received DS unit IDs, a user ID, a vault ID, a securitylevel, a performance level, a data type, metadata, an estimated DS unitperformance level, historical DS unit performance information, a DS unitavailability indicator, and a DS unit capacity level. For example, theprocessing module selects the set of DS units that are associated withestimated DS unit performance levels that each compare favorably to a DSunit performance level threshold.

The method continues at step 240 where the processing module sends theset of encoded data slices to the set of DS units for storage therein.The method continues at step 242 where the processing module updates adirectory. The updating includes modifying the directory to include oneor more of DS unit IDs corresponding to the set of DS units, a datasegment ID corresponding to the data segment, and a set of internetprotocol (IP) addresses associated with the set of DS units. In anexample of a retrieval method of operation, the processing moduleutilizes the filename to index into the directory to extract slicelocations for each data segment, sends read requests to the slicelocations, receives slices, and decodes the slices to reproduce thedata.

FIG. 9A is a diagram illustrating an example of a access requeststructure 244 that includes one or more of a dispersed storage network(DSN) accessing entity address field 246, a vault identifier (ID) field248, an object ID field 250, a filename field 252, an access after timefield 254, an access before time field 256, a requesting entity addressfield 258, and a signature field 260. The access request structure 244may be utilized to generate an access request to request access of aDSN. The access request may be generated in accordance with a uniformresource locator (URL) format. For example, the access request may begenerated in the URL format as:https://east-coast.accesser-pool.acme.com/videovault/31930183023892/video.avi?starttime=12052011&endtime=12172011&ipPattern=156.53.12.x&signature=BF4523A0C1289A179812D1.

The DSN accessing entity address field 246 includes a target (e.g., DSprocessing unit) address entry. For example, the entry may include ahostname pointing to a collection of internet protocol (IP) addressesassociated with a pool of DS processing units to be utilized for accessof the DSN. For instance, an address entryhttps://east-coast.accesser-pool.acme.com points to an East Coast DSprocessing unit pool.

The vault ID field 248 includes a vault ID entry including a name of anassociated vault. For instance, a vault ID entryof/video-vault/specifies a video file vault. The object ID field 250includes an object ID entry utilized by the DSN in a source name and aplurality of sets of slice names of a corresponding plurality of sets ofencoded data slices associated with a filename of data of the request.For instance, an object ID entry of /31930183023892/specifies the objectID utilized by the DSN. The filename field 252 includes a filename entryassociated with the data of the request. The filename may be returned toa requesting entity when retrieving the data associated with thefilename. For instance, a filename entry of video.avi references dataassociated with filename video.avi.

The access after time field 254 includes an access after time entryutilized to control access. For example, access is allowed when acurrent time indicator indicates that current time is after theaftertime entry. For instance, an access after time entry ofstarttime=12052011 indicates that access is allowed when the currenttime is after Dec. 5, 2011. The access before time field 256 includes anaccess before time entry utilized to control access. For example, accessis allowed when the current time indicator indicates that current timeis before the before time entry. For instance, an access before timeentry of endtime=12172011 indicates that access is allowed when thecurrent time is before Dec. 17, 2011.

The requesting entity address field 258 includes a requesting entityaddress entry. The requesting entity address entry includes one or moreof a universally unique ID (UUID), a DSN ID, a user device ID, a DSprocessing unit ID, a DS unit ID, and an IP address pattern. Forinstance, a requesting entity address entry of ipPattern=156.53.12.xindicates an IP address pattern that includes a wildcard at position x.As such, access is allowed when an IP address of a requesting entityincludes an IP address of 156.53.12.1-156.53.12.9. The signature field260 includes a signature entry, wherein the signature entry includes atleast one of a hash-based message authentication code (HMAC) and digitalsignature generated over other parameters of the access request (e.g.,the target DS processing unit address through the requester address).For instance, a signature entry of signature=BF4523A0C1289A179812D1includes hexadecimal encoding of a digital certificate which correspondsto a request verification entity (e.g., signed by) which is authorizedto enable access to the DSN. Alternatively, or in addition to,additional access information may be embedded into the URL of the accessrequest. The additional access information includes one or more of anaccess type (e.g., write, read, delete, list, etc.), permissions,preferred access characteristics, a security indicator, a priorityindicator, a performance level indicator, and reliability levelindicator, and an availability level indicator.

FIG. 9B is a schematic block diagram of an embodiment of a securitysystem for a distributed storage network (DSN) 270 that includes arequesting entity 262, a certificate authority 264, a requestverification entity 266, and a DSN accessing entity 268. One or more ofthe requesting entity 262, the certificate authority 264, the requestverification entity 266, and the DSN accessing entity 268 may beimplemented as part of the DSN 270. The requesting entity 262 may beimplemented as at least one of a user device, a dispersed storage (DS)processing unit, and a DS unit. The certificate authority 264 may beimplemented as a module of at least one of a security server, anauthorization server and a DS managing unit. The DSN accessing entity268 may be implemented as a module of at least one of a DS processingunit, a user device, and a DS unit. The request verification entity 266may be implemented as a module of at least one of a security server, anauthorization server, a DS processing unit, and a DS managing unit. Forexample, the requesting entity 262 is implemented as a user device, thecertificate authority 264 is implemented as a module of a DS managingunit of the DSN 270, the DS and accessing entity 268 is implemented as aDS processing unit 16 of the DSN 270, and the request for locationentity 266 is implemented as a module of the DS processing unit 16 ofthe DSN 270.

The requesting entity 262 sends a certificate signing request (CSR) 272to the certificate authority 264. The certificate signing requestincludes one or more of a requesting entity identifier (ID), a publickey of a public-private key pair associated with the requesting entity262, a password, a shared secret, a signature generated by therequesting entity 262, and authorization information. The certificateauthority 264 authorizes the CSR 272. The authorizing includes one ormore of verifying the signature by the requesting entity 262 utilizingthe public key associated with the requesting entity 262, verifying thepassword, verifying the shared secret, and verifying the authorizationinformation. When authorized, the certificate authority 264 generates asignature over the CSR 272 to produce a signed certificate 274 utilizinga private key of a public-private key pair of the certificate authority264. The certificate authority 264 sends the signed certificate 274 tothe requesting entity 262.

The requesting entity 262 sends a DSN access request 276 to the requestverification entity 266. The DSN access request 276 includes the signedcertificate 274, which indicates that the requesting entity 262 is anauthorized affiliate of the DSN 270, and DSN accessing informationregarding how the requesting entity 262 would like to access the DSN270. The DSN accessing information includes addressing information ofthe requesting entity (e.g., an internet protocol (IP) address of therequesting entity 262, a requesting entity ID), addressing informationof the DSN accessing entity 268 (e.g., an IP address of the DSNaccessing entity 268, a DS processing unit ID, a DS unit ID, a DS unitIP address), data addressing information (e.g., a vault ID, an objectID, a filename, a slice name), and data access timing information (e.g.,an access after time, an access before time).

The request verification entity 266 verifies the signed certificate 274by verifying identity of the certificate authority 264 that generatedthe signed certificate 274 (e.g., check a list, verify a signature). Therequest verification entity 266 verifies the DSN accessing informationby verifying one or more of addressing information of the requestingentity, addressing information of the DSN accessing entity, dataaddressing information, and data access timing information. For example,the request verification entity 266 indicates verified when an IPaddress of the addressing information of the requesting entitysubstantially matches an IP address associated with receiving the DSNaccess request 276. As another example, the request verification entity266 indicates verified when an IP address of the addressing informationof the DSN accessing entity substantially matches an IP address of alist of allowable IP addresses. As yet another example, the requestverification entity 266 indicates verified when data access timinginformation of the DSN access request 276 substantially matches anallowable timeframe of a list of allowable timeframes.

The request verification entity 266 signs the DSN access request 276 bygenerating a signature based on a private key of a public/private keypairing of the request verification entity 266 to produce a signed DSNaccess request 278. The signed DSN access request 278 includes thesignature of the request verification entity 266, the signed certificate274, and the DSN accessing information. The request verification entity266 sends the signed DSN access request 278 to the requesting entity 262when the request verification entity 266 signs the DSN access request276 after verifying the signed certificate 274 and the DSN accessinginformation.

The requesting entity 262 sends the signed DSN access request 278 to theDSN accessing entity 268. The DSN accessing entity 268 sends anauthorized DSN access request 280 to the DSN 270 via a networkconnection when the DSN accessing entity 268 verifies the signature ofthe request verification entity. The DSN accessing entity 268 verifiesthe signature of the request verification entity 266 based on a publickey of the public/private key pairing of the request verificationentity. The DSN accessing entity 268 may further verify at least one ofthe signed certificate 274 and the DSN accessing information. Theauthorized DSN access request 280 includes, at a minimum, at least aportion of the DSN accessing information. The DSN 270 may furtherauthorize the DSN access request 280 by verifying the at least theportion of the DSN accessing information.

FIG. 9C is a flowchart illustrating an example of accessing a dispersedstorage network (DSN). The method begins at step 282 where a requestingentity (e.g., a user device) sends a DSN access request to a requestverification entity (e.g., a dispersed storage (DS) processing unit).The DSN access request includes a signed certificate (e.g., signed by acertificate authority of the DSN), which indicates that the requestingentity is an authorized affiliate of the DSN, and DSN accessinginformation regarding how the requesting entity would like to access theDSN. The method continues at step 284 where the request verificationentity verifies the signed certificate by verifying identity of thecertificate authority that generated the signed certificate (e.g., checka list, verify a signature).

The method continues at step 286 where the request revocation entityverifies the DSN accessing information by verifying one or more ofaddressing information of the requesting entity, addressing informationof the DSN accessing entity, data addressing information, and dataaccess timing information. The method continues at step 288 where therequest revocation entity signs the DSN access request by generating thesignature based on a private key of a public/private key pairing of therequest verification entity. The method continues at step 290 where therequest revocation entity sends a signed DSN access request to therequesting entity when the request verification entity signs the DSNaccess request after verifying the signed certificate and the DSNaccessing information. The signed DSN access request includes asignature of the request verification entity, the signed certificate,and the DSN accessing information.

The method continues at step 292 where the requesting entity sends thesigned DSN access request to a DSN accessing entity (e.g., another DSprocessing unit). The method continues at step 294 where the DSNaccessing entity verifies the signature of the request verificationentity based on a public key of a public/private key pairing of therequest verification entity. The method continues at step 296 where theDSN accessing entity verifies at least one of the signed certificate andthe DSN accessing information.

The method continues at step 298 where the DSN accessing entity sends anauthorized DSN access request to the DSN via a network connection whenthe DSN accessing entity verifies the signature of the requestverification entity. The authorized DSN access request includes, at aminimum, the DSN accessing information. For example, the authorized DSNaccess request may further include the signed certificate and/or thesignature of the request verification entity). In addition, the DSN maysend a DSN access response (e.g., including data, including a slice) inresponse to the DSN access request.

FIG. 10A is a flowchart illustrating an example of establishing accessto a legacy service (e.g., a first-time access). The method begins atstep 300 where a processing module (e.g., of a user device) obtains anew username and a new password associated with a service. The newusername and the new password may be subsequently utilized to access theservice (e.g., a web-based service, a server-based service). Theobtaining includes at least one of receiving a user input, generating arandom password, generating a pseudorandom password, retrieving anexisting username as the new username, generating a random username, andgenerating the new username based on an existing username. For example,the processing module obtains the new username by receiving the userinput and obtains the new password by generating the random password.

The method continues at step 302 where the processing module facilitatesretrieval of a private key from a dispersed credential storage system.For example, the processing module receives a user input password,generates a set of blinded passwords based on the password and a set ofrandom numbers, sends the set of blinded passwords to a set ofauthentication servers, receives a set of passkeys from the set ofauthentication servers, reproduces a set of keys based on the set ofpasskeys and the set of random numbers, decrypts a set of encryptedshares (e.g., retrieved from the set of authentication servers)utilizing the set of keys to reproduce a set of shares, and decodes theset of shares to reproduce the private key.

The method continues at step 304 where the processing module facilitatesretrieval of an encrypted credential package from the dispersedcredential storage system. For example, the processing module generatesa second set of blinded passwords based on the password and/or a seconduser input password and a second set of random numbers, sends the secondset of blinded passwords to the set of authentication servers, receivesa second set of passkeys from the set of authentication servers,reproduces a second set of keys based on the second set of passkeys andthe second set of random numbers, decrypts a second set of encryptedshares (e.g., retrieved from the set of authentication servers)utilizing the second set of keys to reproduce a second set of shares,and decodes the second set of shares to reproduce the encryptedcredential package. Alternatively, the processing module extracts theencrypted credential package from decoding the set of shares thatreproduced the private key.

The method continues at step 306 where the processing module decryptsthe encrypted credential package utilizing the private key to reproducea credential package. The credential package includes one or more of alist of usernames, a list of associated passwords, wherein each usernameis associated with a password, and associated service accessinformation. The associated service access information includes one ormore of a service name, a service identifier (ID), a site address (e.g.,a dispersed storage (DS) unit identifier (ID), a DS unit internetprotocol (IP) address), and a signed certificate. For example, a siteaddress of www.my-email.com is associated with password jq2lk21ejd!23, asecond site address of www.my-bank.com is associated with passwordZ8421Ssa%$#@$rd, and a third site address of www.my-shopping-site.com isassociated with password GHSDasdfa3332. A system improvement may beprovided when a user is not required to remember or write down passwordsfor each service of interest.

The method continues at step 308 where the processing module updates thecredential package to produce an updated credential package. Theupdating includes adding one or more of the new username, the newpassword, and service access information associated with the service tothe credential package to produce the updated credential package.

The method continues at step 310 where the processing module encryptsthe updated credential package to produce an updated encryptedcredential package. The encrypting includes encrypting the updatedcredential package utilizing the private key to produce the updatedencrypted credential package and encrypting the updated credentialpackage utilizing a public key associated with the private key toproduce the updated encrypted credential package.

The method continues at step 312 where the processing module facilitatesstoring the updated encrypted credential package in the dispersedcredential storage system. For example, the processing module receivesthe user input password, generates a new set of keys based on thepassword and a new set of random numbers, encodes the updated encryptedcredential package to produce an updated set of shares, encrypts theupdated set of shares utilizing the new set of keys to produce a new setof encrypted shares, and facilitates storing the new set of encryptedshares and the new set of random numbers (e.g., sending to a set ofauthentication servers for storage therein).

FIG. 10B is a flowchart illustrating an example of accessing a legacyservice that includes similar steps to FIG. 10A. The method begins withsteps 302-306 of FIG. 10A where a processing module (e.g., of a userdevice) facilitates retrieval of a private key from a dispersedcredential storage system, facilitates retrieval of an encryptedcredential package from the dispersed credential storage system, anddecrypts the encrypted credential package utilizing the private key toreproduce a credential package.

The method continues at step 320 where the processing module extracts ausername, a password, and service access information from the credentialpackage. The method continues at step 322 where the processing modulefacilitates service access utilizing the username, the password, and theservice access information. For example, the processing module sends theusername and password to a site address of the service access toinformation.

FIG. 11A is a schematic block diagram of another embodiment of acomputing system that includes a computing device 330 and a dispersedstorage network memory 22. The DSN memory 22 includes a plurality ofsets of storage nodes 342, 344, and 346. Each set of storage nodes ofthe plurality of sets of storage nodes 342-346 includes a plurality ofstorage nodes 106. Each storage node 106 of the plurality of storagenodes 106 may be implemented utilizing at least one of a dispersedstorage (DS) unit, a storage server, a DS processing unit, and a userdevice. The computing device 330 includes a DS module 332. The DS module332 includes a select module 334, an encode module 336, a generatemodule 338, and an output module 340.

The system is operable to encode and store a first group of datasegments 348 of a first data object of a vault as a first plurality ofsets of encoded data slices 350 in the first set of storage nodes 342and to encode and store a second group of data segments 352 of a seconddata object of the vault as a second plurality of sets of encoded dataslices 354 in the second set of storage nodes 344. The first group ofdata segments 348 consisting of one of a first file, a first dataobject, a first data block, a first data stream, and a first filedirectory object. The second group of data segments 352 consisting ofone of a second file, a second data object, a second data block, asecond data stream, and a second file directory object.

For the first group of data segments 348, the select module 334 selectsa first vault parameter set 356 from a plurality of vault parametersets. The first vault parameter set 356 includes a first set ofparameters regarding dispersed error encoding data segments of the firstgroup of data segments 348. The first set of parameters includes one ormore of identity of a first dispersed storage error encoding algorithm(e.g., Reed Solomon, Cauchy Reed Solomon, rateless encoding, etc.),first error coding redundancy information (e.g., pillar width, decodethreshold, write threshold, number of code blocks, etc.), and anidentifier of a set of storage nodes.

The select module 334 selects the first vault parameter set 356 based onone or more of identifying a storage requirement for the first group ofdata segments 348 and interpreting metadata (e.g., first metadata 358)associated with the first group of data segments 348. The storagerequirement includes one or more of a reliability requirement, aperformance requirement, a security requirement, and a storage sizerequirement. The identifying includes at least one of receiving,retrieving, initiating a query, and generating based on at least oneaspect of the metadata. The metadata includes one or more of any datatype indicator, a data size indicator, a data priority indicator, and adata owner. The selecting may include matching the first vault parameterset associated with an estimated performance level that substantiallymeets the storage requirement and/or best aligns with the interpretingthe metadata. For example, the select module 334 selects the first vaultparameter set 356 that is associated with a high level of reliabilitywhen the metadata indicates that the first group of data segments 348includes a financial records data type and requires a highest level ofreliability. As another example, the select module 334 selects the firstvault parameter set 356 that is associated with a high level ofefficiency, and lower reliability, when the metadata indicates that thefirst group of data segments 348 includes a video file data type anddoes not require a high level of reliability.

For the second group of data segments 352, the select module 334 selectsa second vault parameter set 360 from the plurality of vault parametersets. The second vault parameter set 360 includes a second set ofparameters regarding dispersed error encoding data segments of thesecond group of data segments 352. The second set of parameters includesidentity of a second dispersed storage error encoding algorithm andsecond error coding redundancy information. The select module 334selects the second vault parameter set 360 based on one or more ofidentifying a storage requirement for the second group of data segments352 and interpreting metadata (e.g., second metadata 362) associatedwith the second group of data segments 352. The encode module 336encodes the first group of data segments 348 in accordance with thefirst vault parameter set 356 to produce the first plurality of sets ofencoded slices 350. The encode module 336 encodes the second group ofdata segments 352 in accordance with the second vault parameter set 360to produce the second plurality of sets of encoded slices 354.

The generate module 338 generates a first plurality of sets of slicenames 364 for the first plurality of sets of encoded slices 350 inaccordance with the first vault parameter set 356. A slice name of thefirst plurality of sets of slice names to 64 includes a vaultidentifier, a first vault parameter set identifier (e.g., a vaultregion), and a common object name (e.g., an object number) for the firstgroup of data segments 348. The slice name of the first plurality ofsets of slice names 364 further includes a first slice index and a firstsegment number. The first slice index corresponds to a slice numberwithin a set of the first plurality of sets of encoded slices and thefirst segment number corresponds to a data segment number of the firstgroup of data segments 348.

The generate module 338 generates a second plurality of sets of slicenames 366 for the second plurality of sets of encoded slices 354 inaccordance with the second vault parameter set 360. A slice name of thesecond plurality of sets of slice names 366 includes the vaultidentifier (e.g., same as vault identifier for the first plurality ofsets of slice names 364), a second vault parameter set identifier, and acommon object name (e.g., another object number) for the second group ofdata segments 352. The slice name of the second plurality of sets ofslice names 366 further including a second slice index and a secondsegment number. The second slice index corresponds to a slice numberwithin a set of the second plurality of sets of encoded slices and thesecond segment number corresponds to a data segment number of the secondgroup of data segments 352.

The system further functions to select a vault parameter set formetadata of data and to encode metadata to produce slices for storage ina set of storage nodes corresponding to the selected vault parameter setfor the metadata. The select module 334 obtains first metadata 358regarding the first group of data segments 348. For the first metadata358, the select module 334 selects a third vault parameter set 368 fromthe plurality of vault parameter sets. The third vault parameter set 368includes a third set of parameters regarding dispersed error encodingthe first metadata 358. The encode module 336 encodes the first metadata358 in accordance with the third vault parameter set 368 to produce afirst set of metadata encoded slices 370. The generate module 338generates a first set of metadata slice names 372 for the first set ofmetadata encoded slices 370 in accordance with the third vault parameterset 368. A metadata slice name of the first set of metadata slice names372 includes the vault identifier, a third vault parameter setidentifier, and the common object name for the first group of datasegments 348.

The select module 334 obtains second metadata 362 regarding the secondgroup of data segments 352. For the second metadata 362, the selectmodule 334 selects another third vault parameter set 374 from theplurality of vault parameter sets. The another third vault parameter set374 includes a third set of parameters regarding dispersed errorencoding the second metadata 362. The another third vault parameter set374 may be substantially the same as the third vault parameter set 368when storage requirements are substantially the same for the firstmetadata 358 and the second metadata 362. The encode module 336 encodesthe second metadata 362 in accordance with the another third vaultparameter set 374 to produce a second set of metadata encoded slices376. The generate module 338 generates a second set of metadata slicenames 378 for the second set of metadata encoded slices 376 inaccordance with the third vault parameter set 374. A metadata slice nameof the second set of metadata slice names 378 includes the vaultidentifier, a third vault parameter set identifier, and the commonobject name for the second group of data segments 352.

The output module 340 identifies the first set of storage nodes 342 ofthe DSN memory 22 based on the first vault parameter set 356. Forexample, the output module 340 accesses a vault parameter tableutilizing the first vault parameter set identifier to identify the firstset of storage nodes 342. The output module 340 identifies the secondset of storage nodes 344 of the based on the second vault parameter set360. For example, the output module 340 accesses the vault parametertable utilizing the second vault parameter set identifier to identifythe second set of storage nodes 344.

The output module 340 outputs the first plurality of sets of encodedslices 350 to the first set of storage nodes 342. For example, theoutput module 340 generates a first plurality of sets of write slicerequests that includes the first plurality of sets of encoded slices 350and the first plurality of sets of slice names 364. Next, the outputmodule 340 outputs the first plurality of sets of write slice requeststo the first set of storage nodes 342. The output module 340 outputs thesecond plurality of sets of encoded slices 354 to the second set ofstorage nodes 344. The output module 340 outputs the first set ofmetadata encoded slices 370, utilizing the first set of metadata slicenames 372, and the second set of metadata encoded slices 376, utilizingthe second set of metadata slice names 378, to the third set of storagenodes 346 when the select module 334 selects the third vault parameterset 368 for both the first metadata 358 and the second metadata 362.

FIG. 11B is a diagram illustrating an example of a slice name structure380 and example slice names that each include a slice index field 382, avault information field 384, an object number field 386, and a segmentnumber field 388. The slice index field 382 includes a slice index entrycorresponding to a pillar number of an associated encoded data slice.For example, four permutations exist per set of slices when a pillarwidth associated with a set of slices is four. The vault informationfield 384 includes a vault identifier (ID) field 390, a vault regionfield 392, and a vault generation field 394. The vault ID field 390includes a vault ID entry associated with the encoded data slice. Asystem registry may include a user association for the vault ID. Forexample, a first group of users is associated with a first vault ID. Thevault region field 392 includes a vault region entry corresponding tothe encoded data slice and may be utilized to obtain vault regionparameters associated with access of the encoded data slice. The vaultregion parameters includes one or more of an information dispersalalgorithm (IDA) ID, a pillar width, a decode threshold, a writethreshold, a read threshold, a dispersed storage (DS) unit pool ID(e.g., an identifier of a set of storage nodes), and storage addressesof the DS unit pool (e.g., internet protocol addresses of the set ofstorage nodes).

A vault ID may be associated with a plurality of vault regions. Encodeddata slices associated with the vault ID are stored in a dispersedstorage network (DSN) in accordance with vault region parametersassociated with each vault region of the vault ID. An encoded data slicemaybe associated with a data file or metadata of the data file.Different vault regions may be associated with slices of different datatypes including data of different types and metadata associated with thedifferent data types.

The vault generation field 394 includes a vault generation ID and may beutilized to signify generations of encoded data slice that areassociated a common vault ID. The object number field 386 includes anobject number entry. Each data file stored in the DSN is associated witha unique object number. A directory record may be utilized to associatethe unique object number with a data file identifier. The segment numberfield 388 includes a segment number entry. The segment number entry isassociated with a corresponding data segment. For example, four slicenames of first data segment of a data file stored in the DSN include avault ID of A03, a vault generation of 1, an object number of F4D766,and are assigned to a second vault region, wherein the second vaultregion is associated with desired vault region parameters to store thedata. As another example, four slice names of first data segment ofmetadata of the data file stored in the DSN include the vault ID of A03,the vault generation of 1, the object number of F4D766, and are assignedto a first vault region, wherein the first vault region is associatedwith desired vault region parameters to store the metadata (e.g., morereliability than that of storing the data).

FIG. 11C is a diagram illustrating an example of a vault parameter table396 that includes a vault region field 388 and a vault region parametersfield 400. The vault region field 398 includes any number of vaultregion entries. A vault region entry number corresponds to a vaultregion entry of a slice name. The vault region parameters field 400includes a corresponding set of vault region parameter entries. Each setof vault region parameter entries corresponds to a desired approach tostore data of various types and metadata in a dispersed storage network(DSN) memory.

For example, a first vault region includes an information dispersalalgorithm (IDA) 3, a pillar width of 36, a decode threshold of 22, awrite threshold of 34, and a DS unit pool 3 to provide more reliabilityfor storing of metadata. As another example, a second vault regionincludes an information dispersal algorithm (IDA) 5, a pillar width of4, a decode threshold of 3, a write threshold of 3, and a DS unit pool 4to provide more efficiency of storing data of a first data type. As yetanother example, a third vault region includes an information dispersalalgorithm (IDA) 6, a pillar width of 16, a decode threshold of 10, awrite threshold of 12, and a DS unit pool 8 to provide above-averagestorage liability of storing data of a second data type.

FIG. 11D is a flowchart illustrating another example of storing data.For a first group of data segments, the method begins at step 402 wherea processing module (e.g., of a dispersed storage processing unit)selects a first vault parameter set from a plurality of vault parametersets. The first group of data segments consisting of one of a firstfile, a first data object, a first data block, a first data stream, anda first file directory object. The first vault parameter set includes afirst set of parameters regarding dispersed error encoding data segmentsof the first group of data segments. The first set of parametersincludes one or more of identity of a first dispersed storage errorencoding algorithm (e.g., Reed Solomon, Cauchy Reed Solomon, ratelessencoding, etc.), first error coding redundancy information (e.g., pillarwidth, decode threshold, write threshold, number of code blocks, etc.),and an identifier of a first set of storage nodes. The selecting thefirst vault parameter set may be based on one or more of identifying astorage requirement for the first group of data segments andinterpreting metadata associated with the first group of data segments.

The method continues at step 404 where the processing module encodes thefirst group of data segments in accordance with the first vaultparameter set to produce a first plurality of sets of encoded slices.For example, the processing module accesses a vault parameter table toidentify a dispersed storage error coding algorithm associated with thefirst vault parameter set and encodes the first group of data segmentsutilizing the dispersed storage error coding algorithm to produce thefirst plurality of sets of encoded slices. The method continues at step406 where the processing module generates a first plurality of sets ofslice names for the first plurality of sets of encoded slices inaccordance with the first vault parameter set. A slice name of the firstplurality of sets of slice names includes a vault identifier, a firstvault parameter set identifier (e.g., a vault region), and a commonobject name for the first group of data segments. The slice name of thefirst plurality of sets of slice names further includes a first sliceindex and a first segment number. The first slice index corresponds to aslice number within a set of the first plurality of sets of encodedslices and the first segment number corresponds to a data segment numberof the first group of data segments.

For a second group of data segments, the method continues at step 408where the processing module selects a second vault parameter set fromthe plurality of vault parameter sets. The second vault parameter setincludes a second set of parameters regarding dispersed error encodingdata segments of the second group of data segments. The second set ofparameters includes one or more of identity of a second dispersedstorage error encoding algorithm, second error coding redundancyinformation, and an identifier of a second set of storage nodes. Theselecting the second vault parameter set may be based on one or more ofidentifying a storage requirement for the second group of data segmentsand interpreting metadata associated with the second group of datasegments. The method continues at step 410 where the processing moduleencodes the second group of data segments in accordance with the secondvault parameter set to produce a second plurality of sets of encodedslices.

The method continues at step 412 for the processing module generates asecond plurality of sets of slice names for the second plurality of setsof encoded slices in accordance with the second vault parameter set. Aslice name of the second plurality of sets of slice names includes thevault identifier, a second vault parameter set identifier, and a commonobject name for the second group of data segments. The slice name of thesecond plurality of sets of slice names further includes a second sliceindex and a second segment number. The second slice index corresponds toa slice number within a set of the second plurality of sets of encodedslices and the second segment number corresponds to a data segmentnumber of the second group of data segments.

The method continues at step 414 where the processing module obtainsfirst metadata regarding the first group of data segments. The obtainingincludes at least one of retrieving, receiving, and generating. Forexample, the processing module analyzes the data to generate themetadata to include a data size indicator, a data type indicator, and areliability requirement. For the first metadata, the method continues atstep 416 where the processing module selects a third vault parameter setfrom the plurality of vault parameter sets. The third vault parameterset includes a third set of parameters regarding dispersed errorencoding the first metadata. For example, the processing module selectsthe third vault parameter set associated with a highest level ofreliability for encoding the first metadata.

The method continues at step 418 where the processing module encodes thefirst metadata in accordance with the third vault parameter set toproduce a first set of metadata encoded slices. The method continues atthe step where the processing module generates a first set of metadataslice names for the first set of metadata encoded slices in accordancewith the third vault parameter set. A metadata slice name of the firstset of metadata slice names includes the vault identifier, a third vaultparameter set identifier, and the common object name for the first groupof data segments.

The method continues at step 422 where the processing module obtainssecond metadata regarding the second group of data segments. For thesecond metadata, the method continues at step 424 where the processingmodule selects another third vault parameter set (e.g., same ordifferent than the third vault parameter set for the first metadata)from the plurality of vault parameter sets. The other third vaultparameter set includes another third set of parameters regardingdispersed error encoding the second metadata. For example, theprocessing module selects the third vault parameter set as the otherthird vault parameter set when a storage requirement for the secondmetadata is substantially the same as a storage compartment for thefirst metadata.

The method continues at step 426 where the processing module encodes thesecond metadata in accordance with the other third vault parameter setto produce a second set of metadata encoded slices. The method continuesat step 428 where the processing module generates a second set ofmetadata slice names for the second set of metadata encoded slices inaccordance with the other third vault parameter set. A metadata slicename of the second set of metadata slice names includes the vaultidentifier, another third vault parameter set identifier, and the commonobject name for the second group of data segments.

The method continues at step 430 where the processing module identifiesa first set of storage nodes of a distributed storage network (DSN)based on the first vault parameter set. The method continues at step 432where the processing module identifies a second set of storage nodes ofthe based on the second vault parameter set. The method continues atstep 434 where the processing module outputs the first plurality of setsof encoded slices to the first set of storage nodes. The methodcontinues at step 436 where the processing module outputs the secondplurality of sets of encoded slices to the second set of storage nodes.The method continues at step 438 where the processing module identifiesa third set of storage nodes based on the third vault parameter set. Themethod continues at step 440 where the processing module identifiesanother third set of storage nodes based on the other third vaultparameter set. The method continues at step 442 where the processingmodule outputs the first set of metadata encoded slices to the third setof storage nodes. The method continues at step 444 where the processingmodule outputs the second set of metadata encoded slices to the otherthird set of storage nodes.

Referring next to FIGS. 12A and 12B, various embodiments in which usersof dispersed credentials may have their own choice of provider(s), yetto be able to authenticate to any given service on the internet. Tosupport this a user may use a username of the form“user_name@their_auth_providers_domain.com”. When registering anaccount, the user would provide this full username, which includes boththeir name and the domain name. The domain name section resolves to aserver from which the CA certificate which issued the end user'scertificate can be downloaded. For example:“https://their_auth_providers_domain.com/dispersed-credentials-ca-certificate.pem”.

The “user_name” part of username will, in various embodiments, also belinked to the certificate, either as part of the UID or the CommonName(CN) of the Subject Distinguished Name of their user certificate. Thesetwo parameters enable the provider to verify the uniqueness of thecertificate as well as determine that it was issued by the correct CA.Centralization is avoided as anyone with a domain name could place theirCA issuing certificate up and then have a dispersed credentials accountwhich can be used to log into any website. The end user may renew theircertificate so long as the Subject DN contains the appropriate field,and may even renew from a different CA so long as they have the abilityto update the CA hosted on their domain. Sites at which the userregisters need only associate the account with the username of the form“user_name@their_auth_providers_domain.com”, no knowledge of thecertificate or a password need be registered.

FIG. 12A is a flowchart illustrating another example of generating anaccess request. The method begins at step 446 where a processing module(e.g., of a user device) generates an access request that includes ausername, a certificate authority (CA) domain name, and a usercertificate. The CA domain name includes a name of an associated CA thatsigned the user certificate and may be included in a username field. Themethod continues at step 448 where the processor module outputs accessrequest. For example, the processing module sends the access request toa dispersed storage (DS) unit to access an encoded data slice.

The method continues at step 450 where the processing module receives anauthentication request. The authentication request includes a request toproduce a result utilizing a private key by at least one of signing amessage, encrypting the message, and decrypting the message. The methodcontinues at step 452 where the processing module generates anauthentication response to include the corresponding result. The methodcontinues at step 454 where the processing module outputs theauthentication response. For example, the processing module sends theauthentication response to a requesting entity associated with theauthentication request.

FIG. 12B is a flowchart illustrating another example of processing anaccess request. The method begins at step 456 where a processing module(e.g., of a dispersed storage (DS) unit) receives an access request thatincludes a user certificate. The method continues at step 458 where theprocessing module authenticates the user certificate. For example, theprocessing module sends an authentication request to a requesting entityof the access request, receives an authentication response, andindicates that the user certificate is authenticated when theauthentication response is favorable (e.g., a returned signature isvalid, comparing a decrypted encrypted received message to an originalmessage is favorable, comparing a decrypted message to an originalmessage is favorable). Such a step authenticates that the requestingentity is in possession of a private key utilized to produce the usercertificate. When the user certificate is authenticated, the methodcontinues at step 460 where the processing module extracts a usernameand a certificate authority (CA) domain name from the access request.

The method continues at step 462 where the processing module obtains aCA certificate utilizing the domain name. For example, the processingmodule sends a certificate request to a CA utilizing the CA domain namefrom the access request and receives the CA certificate in response. Themethod continues at step 464 where the processing module validates thesignature of the user certificate utilizing the CA certificate. Theprocessing module indicates that the signature of the user certificateis valid when the signature validation is favorable utilizing a publickey from the CA certificate. The method continues at step 466 where theprocessing module facilitates access (e.g., write, read, delete, list,etc.) when the signature is validated.

As an example, an access request is received as:https://their_auth_providers_domain.com/dispersed-credentials-ca-certificate.pem”.A “user_name” part of username may be linked to the certificate, eitheras part of a userid (UID) and a CommonName (CN) of a SubjectDistinguished Name of the user certificate. These two parameters enablea service provider to verify uniqueness of the certificate as well asdetermine that it was issued by a correct CA. As such, centralization isavoided as anyone with a domain name could place their CA issuingcertificate up and then have a dispersed credentials account which canbe used to log into any website. The end user may renew theircertificate so long as the Subject DN contains the appropriate field,and may even renew from a different CA so long as the user has theability to update the CA hosted on their domain. Sites at which the userregisters need only associate an account with a username of the form“user_name@their_auth_providers_domain.com”, no knowledge of thecertificate or a password need be pre-registered.

FIG. 13A is a schematic block diagram of an embodiment of a system forstoring a large data object in a dispersed storage network (DSN) thatincludes a partitioner 470, a boundary generator 472, a directoryaccessor 474, a file directory 476, a plurality of DSN addressgenerators 1-N, a plurality of encoders 1-N, a plurality of write slicerequest generators 1-N, and a DSN memory 22. The system is operable tostore data 478 in accordance with retrieval preferences 482 in the DSNmemory 22.

The boundary generator 472 receives retrieval preferences 482. Thereceiving includes at least one of initiating a user query, receiving auser input, retrieving from a local memory, receiving from the DSNmemory, and generating based on one or more of historical retrievalpreferences, a dynamic analysis of the data 478, and performance of theDSN memory 22. A retrieval preference of the retrieval preferences 482includes at least one of a keyword, a datatype, a previous retrievalpreference, a data transition indicator, a pattern, a data value, and adata size.

The boundary generator 472 generates data boundary information 484 basedon the retrieval preferences 482 and the data 478. The data boundaryinformation 484 includes one or more of a boundary indicator betweendata partitions of a plurality of data partitions 1-N, a data elementidentifier associated with a data partition, a transition pointdesignator, a data partition size indicator, a number of data partitionsvalue, a data partition designator (e.g., partition 1 partition 2,etc.), and a data partition type indicator. The generating includes atleast one of dividing a data size associated with the data 478 by anumber of desired partitions to identify the partition size indicator ofthe data boundary information, dividing the data size associated withthe data 478 by a desired data partition size to produce a number ofdata partitions indicator, detecting a datatype transition within thedata 478 and identifying a boundary associated with the transition, anddetecting a desired datatype of a data element within the data 478 andidentifying a boundary associated with the data element.

The partitioner 470 partitions the data 478 into the plurality of datapartitions 1-N in accordance with the data boundary information 484. Forexample, the partitioner 470 utilizes boundary designators of the databoundary information 484 to identify breakpoints between neighboringdata partitions of the plurality of data partitions 1-N to form theneighboring data partitions. As another example, the partitioner 470utilizes a partition size indicator for one or more data partitions topartition the plurality of data partitions 1-N. Each encoder of theplurality of encoders 1-N encodes a corresponding data partitionutilizing a dispersed storage error coding function to produce acorresponding plurality of encoded partition slices of a plurality ofpluralities of sets of encoded partition slices 1-N.

The directory accessor 474 receives a data identifier (ID) 480. The dataID 480 corresponds to the data 478. The data ID 480 may include one ormore of a data name, a data object identifier, a data alias, an owneridentifier, and vault ID. The directory accessor 474 may generate a dataobject ID 488 that corresponds to the data ID 480. The data object ID488 corresponds to the data 478. The data object ID 488 includes atleast one of a base source name, the vault ID, vault generation number,and an object number. The base source name includes the vault ID, thevault generation number, and the object number. The object number may begenerated based on one of a random number and a deterministic functionof one or more of the data ID 480 and a portion of the data 478. Forexample, the directory accessor 474 generates the object number as arandom number. As another example, the directory accessor 474 performs ahashing function on the data ID to produce the data object ID 488. Thedirectory accessor 474 associates the data ID 480 and the data object ID488 to produce association information 486. The associating includesgenerating a file directory entry for a directory utilized to access theDSN memory 22. The directory accessor 474 facilitates storage of theassociation information 486 in the file directory 476.

Each DSN address generator of the plurality of DSN address generators1-N generates a plurality of sets of DSN addresses for a correspondingset of partition encoded data slices based on the data object ID 488 andthe data boundary information 484. The plurality of DSN addressgenerators 1-N generates a plurality 1-N of the plurality of sets of DSNaddresses for the plurality of plurality 1-N of partition encoded dataslices. A DSN address of the plurality of sets of DSN addresses includesdispersed storage addressing information and a data representation value(e.g., forming a unique object number corresponding to the dataportion). Such a DSN address may be represented as a slice name 490. Theslice name 490 includes a slice index field 492, a vault ID field 494, adata representation field 496, and a segment number field 498. The sliceindex field 492 includes a slice index entry including at least one of avalue derived from a pillar number, a slice number, and a pillar numberof a width number of pillar number values. The vault ID field 494includes a vault ID entry associated with the data 478. The segmentnumber field 498 includes a segment number entry of a plurality ofsegment number values associated with a corresponding data partition ofthe plurality of data partitions 1-N. The data representation field 496includes the data representation value associated with the datapartition. The data representation value includes one or more of arepresentation of the data object ID 488, a representation of theretrieval preferences 482, and a representation of a correspondingportion of the data boundary information 484.

The DSN address generator generates the data representation value of theDSN address by generating one or more of the representation of the dataobject ID 488, the representation of the retrieval preferences 482, andthe representation of the corresponding portion of the data boundaryinformation 484. The DSN address generator generates a representationbased on at least one of a value (e.g., data object ID, retrievalpreference, data boundary info), a coding of the value (e.g., anumerical value as a representation corresponding to the value), and adeterministic function performed on the value (e.g., performing ahashing function on the value to produce the representation).Alternatively, or in addition to, the DSN address generator generatesthe data representation value by performing a further coding ordeterministic function on a combination of the representation of thedata object ID 488, the representation of the retrieval preferences 482,and the representation of the corresponding portion of the data boundaryinformation 484. For example, the DSN address generator utilizes thedata object ID 488 as is, generates a coded value for the retrievalpreferences 482 (e.g., by a table lookup for coded values of retrievalpreferences), performs a hashing function on a portion of the databoundary information 484 associated with the corresponding datapartition to produce a hash digest representation of the data boundaryinformation, and sums the data object ID 488, the coded value for theretrieval preferences, and the hash digest representation of the databoundary information to produce the data representation value.

Each write slice request generator of the plurality of write slicerequest generators 1-N generates a plurality of write slice requeststhat includes a corresponding plurality of partition encoded data slicesand a corresponding plurality of DSN addresses. The write slice requestgenerator outputs the plurality of write slice requests to the DSNmemory 22.

FIG. 13B is a schematic block diagram of an embodiment of a system forretrieving a large data object in a dispersed storage network (DSN) thatincludes a boundary generator 500, a directory accessor 474, a filedirectory 476, a DSN address generator 502, a read slice requestgenerator 504, a DSN memory 22, and a decoder 506. The system functionsto retrieve a recovered desire data portion 518 of data from the DSNmemory 22 based on a retrieval preference 508 and a data identifier (ID)480.

The directory accessor 474 receives the data identifier (ID) 480. Thedata ID 480 corresponds to the data. The data ID 480 may include one ormore of a data name, a data object identifier, a data alias, an owneridentifier, and vault ID. The file directory 476 includes associationinformation 486. The association information 486 associates the data ID480 and a data object ID 488. The data object ID 488 includes at leastone of a base source name, the vault ID, vault generation number, and anobject number. The base source name includes the vault ID, the vaultgeneration number, and the object number. The object number may begenerated based on one of a random number and a deterministic functionof one or more of the data ID 480 and a portion of the data. Thedirectory accessor 474 retrieves the association information 486 fromthe file directory 476 based on the data ID 480. The directory accessor474 outputs the data object ID 488 to the DSN address generator 502.

The boundary generator 500 receives the retrieval preference 508 from arequesting entity to retrieve the desired data portion 518. Thereceiving includes at least one of initiating a user query, receiving auser input, retrieving from a local memory, receiving from the DSNmemory, and generating based on one or more of historical retrievalpreference and a dynamic analysis of the data. The retrieval preference508 includes at least one of a keyword, a datatype, a previous retrievalpreference, a data transition indicator, a pattern, a data value, and adata size.

The boundary generator 500 generates corresponding boundary information510 based on the retrieval preference 508. The corresponding boundaryinformation 510 includes one or more of a boundary indicator associatedwith a data partition corresponding to the desired data portion 518, adata element identifier associated with the data partition, a transitionpoint designator, a data partition index, and a data size indicator. Thegenerating includes at least one of dividing a data size associated withthe data by a number of estimated partitions to identify a partitionsize indicator of the data boundary information, dividing the data sizeassociated with the data by a known data partition size to produce anumber of data partitions indicator, identifying a boundary associatedwith the transition, identifying a boundary associated with the desiredata portion, performing a deterministic function on the retrievalpreference, retrieving the boundary information 510 from a table basedon indexing into the table utilizing the retrieval preference 508, andreceiving the boundary information 510. For example, the processingmodule calculates a coded value for the retrieval preference 508 byperforming a hashing function on the retrieval preference 508 andperforms a mask generating function on the coded value to generate theboundary information 510.

The DSN address generator 502 generates a plurality of sets of DSNaddresses 512 based on the corresponding boundary information 510 in thedata object ID 488. A DSN address of the plurality of sets of encodedDSN addresses 512 includes a representation of the data object ID 488, arepresentation of the retrieval preference 508 (e.g., via the boundaryinfo), a representation of the corresponding data boundary information510, and dispersed storage addressing information. The DSN addressincludes the dispersed storage addressing information and a datarepresentation value (e.g., a unique object number corresponding to thedesired data portion) that includes the representation of the dataobject identifier, the representation of the retrieval preference, andthe representation of the corresponding data boundary information.

The DSN address generator 502 may generate the data representation valueas a resultant of a deterministic function being performed on the dataobject ID 488 and the representation of the retrieval preference and therepresentation of the corresponding data boundary information. Forexample, the processing module generates a data representation value asa sum of the data object ID 488 and a resultant of a hashing functionbeing performed on a retrieval preference for a video scene thatincludes an ocean. As another example, the processing module generatesanother data representation value as a sum of the data object identifierand a resultant of a hashing function being performed on a desired videoscene transition portion of a data boundary associated with video of theocean.

The read slice request generator 504 generates a plurality of sets ofread slice request 514 that includes the plurality of DSN addresses 512.To read slice request generator 504 outputs the plurality of sets ofread slice request 514 for the DSN memory 22. The decoder 506 receivesdesired portion slices 516 that includes at least a decode thresholdnumber of encoded data slices per set of a plurality of sets of encodeddata slices corresponding to the desired data portion 518. The decoder506 decodes the desired portion slices 516 utilizing a dispersed storageerror coding function to produce the recovered desire data portion 518.

FIG. 13C is a schematic block diagram of another embodiment of a systemfor storing a large data object in a dispersed storage network (DSN)that includes a computing device 520 and a DSN memory 22. The DSN memory22 includes a plurality of storage nodes 106. Each storage node 106 ofthe plurality of storage nodes 106 may be implemented utilizing at leastone of a dispersed storage (DS) unit, a storage server, a DS processingunit, and a user device. The computing device 520 includes a DS module522. The computing device 520 may be implemented utilizing at least oneof a DS unit, a DS processing unit, and a user device. The DS module 522includes a generate identifier (ID) module 524, a partition module 526,an encode module 528, and a generate addresses module 530. The systemfunctions to store data 478 as a plurality of data partitions 532 in theDSN memory 22 based on retrieval preferences 482. For example, thecomputing device 520 is implemented as a DS processing unit to store thedata 478 in the DSN memory 22.

The generate ID module 524 generates a data object identifier 488 fordata 478 to be stored in the DSN memory 22. For example, the generate IDmodule 524 generates an object number value of a source name field asthe data object identifier 488 based on a random number generator.Alternatively, the generate ID module 524 performs a deterministicfunction on at least a portion of the data 478 to generate the dataobject identifier 488. The deterministic function includes at least oneof a hashing function, an addition function, a subtraction function, anexclusive OR logical function, a cyclic redundancy check function, ahash-based message authentication code (HMAC) function, and a maskgenerating function (MGF). For example, the generate ID module 524performs the MGF on a first portion (e.g., 1 million bytes) of the data478 to produce the data object identifier 488 with a desired number ofbits for the object number value.

The partition module 526 partitions the data 478 into a plurality ofdata partitions 532 based on a set of retrieval preferences 482 and databoundary information 484. The partition module 526 obtains the databoundary information 484 by at least one of receiving and generating.The generating may be based on one or more of the retrieval preferences482 and the data 478. For example, the partition module 526 analyzes thedata 478 based on a retrieval preference 482 associated with videoscenes to produce data boundary information 484 that includes anidentification of a data element associated with an ocean video scene.The partition module 526 may further analyze the data 478 in accordancewith the data boundary information 484 to identify data elements of thedata 478 that correspond to a retrieval preference of the set ofretrieval preferences 482 to determine a plurality of data boundariescorresponding to the plurality of data partitions. The partition module526 may insert the data boundary information 484 into the data 478enabling subsequent enhanced content identification during a retrievalsequence.

For a data partition of the plurality of data partitions 532, the encodemodule 528 dispersed storage error encodes the data partition to producea plurality of sets of encoded data slices 534. For the data partitionof the plurality of data partitions 532, the generate addresses module530 generates a plurality of sets of DSN addresses 536 (e.g., new slicename format) for the plurality of sets of encoded data slices 534. A DSNaddress of the plurality of sets of DSN addresses 536 includes arepresentation of the data object identifier, a representation of one ormore retrieval preferences of the set of retrieval preferences, arepresentation of a corresponding portion of the data boundaryinformation, and dispersed storage addressing information. The DSNaddress includes the dispersed storage addressing information and a datarepresentation value (e.g., a unique object number corresponding to thedata portion) that includes the representation of the data objectidentifier, the representation of one or more retrieval preferences ofthe set of retrieval preferences, and the representation of thecorresponding portion of the data boundary. The dispersed storageaddressing information includes a storage node identifier (e.g., a sliceindex), a data segment number corresponding to a data segment of thedata portion, a vault identifier that identifies user device informationassociated with the data. The data partition can be retrieved fromstorage by obtaining the data object identifier 488 via a file directoryaccess and calculating the plurality of sets of DSN addresses 536 basedon the data object identifier 488 and the one or more retrievalpreferences 482.

The generate address module 530 may generate the data representationvalue as a resultant of a deterministic function being performed on thedata object identifier 488 and the representation of one or more of theone or more retrieval preferences of the set of retrieval preferences482 and the representation of the corresponding portion of the databoundary. For example, the generate address module 530 generates a datarepresentation value as a sum of the data object identifier 488 and aresultant of a hashing function being performed on a retrievalpreference for a video scene that includes an ocean. As another example,the generate address module 530 generates another data representationvalue as a sum of the data object identifier 488 and a resultant of ahashing function being performed on a desired video scene transitionportion of the data boundary associated with video of the ocean.

The representation of the data object identifier includes one of a DSNbase source name that is generated from the data object identifier, aresultant of a deterministic function being performed on the data objectidentifier, and the data object identifier. The representation of one ormore retrieval preferences includes one of a code value representing aretrieval preference of the one or more retrieval preferences, aresultant of a deterministic function being performed on the one or moreretrieval preferences, and the one or more retrieval preferences. Therepresentation of a corresponding portion of the data boundaryinformation includes one of a code value representing the correspondingportion of the data boundary information, a resultant of a deterministicfunction being performed on the corresponding portion of the databoundary information, and the corresponding portion of the data boundaryinformation.

For the data partition of the plurality of data partitions 532, the DSmodule 522 generates a plurality of sets of write slice requests 538that includes the plurality of sets of encoded data slices 534 and acorresponding plurality of sets of DSN addresses 536. The DS module 522outputs the plurality of sets of write slice requests 538 to the DSNmemory 22.

FIG. 13D is a flowchart illustrating another example of storing data.The method begins at step 540 were a processing module (e.g., of adispersed storage (DS) processing unit) generates a data objectidentifier for data to be stored in a dispersed storage network (DSN).The method continues at step 542 where the processing module analyzesthe data in accordance with data boundary information to identify dataelements of the data that correspond to a retrieval preference of a setof retrieval preferences to determine the data partition. The methodcontinues at step 544 where the processing module partitions the datainto a plurality of data partitions based on the set of retrievalpreferences and the data boundary information. The method continues atstep 546 where the processing module inserts the data boundaryinformation into the data.

For a data partition of the plurality of data partitions, the methodcontinues at step 548 where the processing module dispersed storageerror encodes the data partition to produce a plurality of sets ofencoded data slices. The method continues at step 550 where theprocessing module generates a plurality of sets of DSN addresses for theplurality of sets of encoded data slices. A DSN address of the pluralityof sets of DSN addresses includes a representation of the data objectidentifier, a representation of one or more retrieval preferences of theset of retrieval preferences, a representation of a correspondingportion of the data boundary information, and dispersed storageaddressing information. The data partition can be retrieved from storageby obtaining the data object identifier via a file directory access andcalculating the plurality of sets of DSN addresses based on the dataobject identifier and the one or more retrieval preferences.

The representation of the data object identifier includes one of a DSNbase source name that is generated from the data object identifier, aresultant of a deterministic function being performed on the data objectidentifier, and the data object identifier. The representation of one ormore retrieval preferences includes one of a code value representing aretrieval preference of the one or more retrieval preferences, aresultant of a deterministic function being performed on the one or moreretrieval preferences, and the one or more retrieval preferences. Therepresentation of a corresponding portion of the data boundaryinformation includes one of a code value representing the correspondingportion of the data boundary information, a resultant of a deterministicfunction being performed on the corresponding portion of the databoundary information, and the corresponding portion of the data boundaryinformation. The dispersed storage addressing information includes astorage node identifier (e.g., a slice index), a data segment numbercorresponding to a data segment of the data portion, and a vaultidentifier that identifies user device information associated with thedata.

The method continues at step 552 where the processing module generates aplurality of sets of write slice requests that includes the plurality ofsets of encoded data slices and the plurality of sets of DSN addresses.The method continues at step 554 where the processing module outputs theplurality of sets of write slice requests to the DSN.

FIG. 13E is a schematic block diagram of another embodiment of a systemfor retrieving a large data object in a dispersed storage network (DSN)that includes a computing device 560 and a DSN memory 22. The DSN memory22 includes a plurality of storage nodes 106. Each storage node 106 ofthe plurality of storage nodes 106 may be implemented utilizing at leastone of a dispersed storage (DS) unit, a storage server, a DS processingunit, and a user device. The computing device 560 includes a DS module562. The computing device 560 may be implemented utilizing at least oneof a DS unit, a DS processing unit, and a user device. The DS module 562includes a receive module 564, a boundary info module 566, a calculateaddresses module 568, and a retrieve module 570. The system functions toretrieve a data portion 572 of data stored in the DSN memory 22 based ona retrieval preference 574. For example, the computing device 560 isimplemented as a DS processing unit to retrieve the data portion 572from the DSN memory 22.

The receive module 564 receives a data object identifier 488 via a filedirectory access. The data object identifier 488 identifies data storedin the DSN memory 22. The receive module 564 receives the retrievalpreference 574 (e.g., a partition attribute) to retrieve the dataportion 572 of the data. The receive module 546 receives the retrievalpreference 574 by receiving a requested data preference 576 and equatingthe requested data preference 576 to one or more preferences of a set ofretrieval preferences to produce the retrieval preference 574. Theequating includes at least one of a best matching, and interactiveselection process and a selection from a list.

The boundary information module 566 determines corresponding databoundary information 578 based on the retrieval preference 574. Theboundary information module 566 identifies a data element based on theretrieval preference 574 to produce the data boundary information 578.For example, the boundary information module 566 identifies a videoscene transition as the boundary information 578 based on a new videoscene retrieval preference 574.

The calculate addresses module 568 calculates a plurality of sets of DSNaddresses 580 based on the data object identifier 488, the retrievalpreference 574, and the corresponding data boundary information 578. ADSN address of the plurality of sets of encoded DSN addresses 580includes a representation of the data object identifier, arepresentation of the retrieval preference, a representation of thecorresponding data boundary information, and dispersed storageaddressing information. The representation of the data object identifierincludes one of a DSN base source name that is generated from the dataobject identifier 488, a resultant of a deterministic function beingperformed on the data object identifier, and the data object identifier488. The representation of one or more retrieval preferences includesone of a code value representing a retrieval preference of the retrievalpreference, a resultant of a deterministic function being performed onthe retrieval preference 574, and the retrieval preference 574. Therepresentation of the corresponding data boundary information includesone of a code value representing the corresponding data boundaryinformation, a resultant of a deterministic function being performed onthe corresponding the data boundary information 578, and thecorresponding data boundary information 578. The dispersed storageaddressing information includes a storage node identifier, (e.g., apillar index), a data segment number corresponding to a data segment ofthe data portion 572, and a vault identifier that identifier user deviceinformation associated with the data.

The retrieve module 570 retrieves the data portion 572 based on theplurality of sets of DSN addresses 580. The retrieve module 570generates a plurality of sets of read slice requests 582 that includesthe plurality of sets of DSN addresses 580. The retrieve module 570outputs the plurality of sets of read slice requests 582 to the DSNmemory 22. The retrieve module 570 receives at least a decode thresholdnumber of encoded data slices per set of encoded data slices of aplurality of sets of encoded data slices corresponding to the pluralityof sets of DSN addresses 580. The retrieve module 570 decodes the atleast the decode threshold number of encoded data slices per set ofencoded data slices of the plurality of sets of encoded data slices toreproduce the data portion 572.

FIG. 13F is a flowchart illustrating an example of retrieving data. Themethod begins at step 590 where a processing module (e.g., of adispersed storage (DS) processing unit) receives a data objectidentifier (e.g., a base source name) via a file directory access.Alternatively, the processing module receives the data object identifierfrom a requesting entity. The data object identifier identifies datastored in a dispersed storage network (DSN). The data object may bestored in the DSN as a plurality of partitions. The method continues atstep 592 where the processing module receives a retrieval preference(e.g., a partition attribute) to retrieve a data portion of the data.The receiving the retrieval preference includes receiving a requesteddata preference and equating the requested data preference to one ormore preferences of a set of retrieval preferences to produce theretrieval preference. The processing module may obtain the set ofretrieval preferences by one or more of receiving, retrieving from amemory, retrieving from the DSN, obtaining from a user, and generatingbased on user input.

The method continues at step 594 where the processing module determinescorresponding data boundary information based on the retrievalpreference. The determining may be based on one or more of performing adeterministic function on the retrieval preference to generate the databoundary information, retrieving the data boundary information from atable based on indexing into the table utilizing the retrievalpreference, and receiving the data boundary information. For example,the processing module calculates a coded value for the retrievalpreference by performing a hashing function on the retrieval preferenceand performs a mask generating function on the coded value to generatethe data boundary information.

The method continues at step 596 where the processing module calculatesa plurality of sets of DSN addresses based on the data objectidentifier, the retrieval preference, and the corresponding databoundary information. A DSN address of the plurality of sets of encodedDSN addresses includes a representation of the data object identifier, arepresentation of the retrieval preference, a representation of thecorresponding data boundary information, and dispersed storageaddressing information. The DSN address includes the dispersed storageaddressing information and a data representation value (e.g., a uniqueobject number corresponding to the data portion) that includes therepresentation of the data object identifier, the representation of theretrieval preference, and the representation of the corresponding databoundary information.

The processing module may generate the data representation value as aresultant of a deterministic function being performed on the data objectidentifier and the representation of the retrieval preference and therepresentation of the corresponding data boundary information. Forexample, the processing module generates a data representation value asa sum of the data object identifier and a resultant of a hashingfunction being performed on a retrieval preference for a video scenethat includes an ocean. As another example, the processing modulegenerates another data representation value as a sum of the data objectidentifier and a resultant of a hashing function being performed on adesired video scene transition portion of a data boundary associatedwith video of the ocean.

The representation of the data object identifier includes one of a DSNbase source name that is generated from the data object identifier, aresultant of a deterministic function being performed on the data objectidentifier, and the data object identifier. The representation of theretrieval preference includes one of a code value representing aretrieval preference of the retrieval preference, a resultant of adeterministic function being performed on the retrieval preference, andthe retrieval preference. The representation of the corresponding databoundary information includes one of a code value representing thecorresponding data boundary information, a resultant of a deterministicfunction being performed on the corresponding the data boundaryinformation, and the corresponding data boundary information. Thedispersed storage addressing information includes a storage nodeidentifier (e.g., a pillar index), a data segment number correspondingto a data segment of the data portion, and a vault identifier thatidentifier user device information associated with the data.

The method continues at step 598 where the processing module retrievesthe data portion based on the plurality of sets of DSN addresses. Forexample, the processing module generates a plurality of sets of readrequests that includes the plurality of sets of DSN addresses andoutputs the plurality of sets of read requests to the DSN. Theprocessing module receives at least a decode threshold number of encodeddata slices per set of encoded data slices of a plurality of sets ofencoded data slices corresponding to the plurality of sets of DSNaddresses. The processing module decodes the at least the decodethreshold number of encoded data slices per set of encoded data slicesof the plurality of sets of encoded data slices to produce the dataportion.

FIG. 14 is a flowchart illustrating another example of retrieving data.The method begins at step 600 where a processing module (e.g., of adispersed storage (DS) processing unit) identifies DS units of a DS unitstorage set. The identifying includes at least one of reproducing adispersed storage network (DSN) address (e.g., a source name, a slicename) based on a filename of the data to be retrieved, extracting DSunit identifiers (IDs) of the DS unit storage set from a DSN address tophysical location table lookup, receiving the DS unit IDs, and a query.

The method continues at step 602 where the processing module obtainsstorage parameters utilized to store data in the DS unit storage set.The obtaining includes at least one of a lookup, a retrieval, a query,and receiving the parameters. For example, the processing moduleextracts the parameters from a vault associated with the data. Themethod continues at step 604 where the processing module obtains DS unitperformance information corresponding to each DS unit of the DS unitstorage set. The DS unit performance information includes one or more ofa number of timed out requests, a number of failed requests as apercentage of total requests for each connection to the DS unit, anoverall failure rate, an access bandwidth indicator, an access latencyindicator, and an availability indicator. The obtaining includes atleast one of a lookup, a retrieval, a query, and receiving theinformation. For example, the processing module accesses a DS unithistory record to extract the DS unit performance information.

The method continues at step 606 where the processing module determinesa desired performance level with regards to reproducing the data. Theperformance level includes metrics of the issuer performanceinformation. The determining may be based on at least one of the DS unitperformance information, a data type of the data, a desired performancelevel based on data type list, a lookup, a retrieval, a query, andreceiving the information. For example, the processing module determinesthat the desired performance level includes a maximum failure rate ofreproducing the data in a first attempt as 0.1% based on a desireperformance level list lookup.

The method continues at step 608 where the processing module selects asubset of the DS units based on one or more of the storage parameters,the DS unit performance information, and the desire performance level.For example, the processing module chooses a number of DS units based ona desire performance level and subsequently selects the number of DSunits such that a probability of a successful reproduction of the datais greater than a probability of successful reproduction of the dataassociated with the desired performance level. The method continues atstep 610 where the processing module sends a read request to each DSunit of the subset of DS units to retrieve a plurality of subsets ofencoded data slices. The processing module receives at least a decodethreshold number of encoded data slices per set of the plurality of setsof encoded data slices to enable a successful reproduction of the data,wherein the probability of successful reproduction of the data isgreater than the successful reproduction of the data probabilityassociated with the desire performance level. A network congestionsystem improvement may be provided such that read requests are sent tothe subset of DS units and not to a full pillar width of DS units of theDS unit storage set.

As may be used herein, the terms “substantially” and “approximately”provides an industry-accepted tolerance for its corresponding termand/or relativity between items. Such an industry-accepted toleranceranges from less than one percent to fifty percent and corresponds to,but is not limited to, component values, integrated circuit processvariations, temperature variations, rise and fall times, and/or thermalnoise. Such relativity between items ranges from a difference of a fewpercent to magnitude differences. As may also be used herein, theterm(s) “operably coupled to”, “coupled to”, and/or “coupling” includesdirect coupling between items and/or indirect coupling between items viaan intervening item (e.g., an item includes, but is not limited to, acomponent, an element, a circuit, and/or a module) where, for indirectcoupling, the intervening item does not modify the information of asignal but may adjust its current level, voltage level, and/or powerlevel. As may further be used herein, inferred coupling (i.e., where oneelement is coupled to another element by inference) includes direct andindirect coupling between two items in the same manner as “coupled to”.As may even further be used herein, the term “operable to” or “operablycoupled to” indicates that an item includes one or more of powerconnections, input(s), output(s), etc., to perform, when activated, oneor more its corresponding functions and may further include inferredcoupling to one or more other items. As may still further be usedherein, the term “associated with”, includes direct and/or indirectcoupling of separate items and/or one item being embedded within anotheritem. As may be used herein, the term “compares favorably”, indicatesthat a comparison between two or more items, signals, etc., provides adesired relationship. For example, when the desired relationship is thatsignal 1 has a greater magnitude than signal 2, a favorable comparisonmay be achieved when the magnitude of signal 1 is greater than that ofsignal 2 or when the magnitude of signal 2 is less than that of signal1.

As may be used herein, the terms “substantially” and “approximately”provides an industry-accepted tolerance for its corresponding termand/or relativity between items. Such an industry-accepted toleranceranges from less than one percent to fifty percent and corresponds to,but is not limited to, component values, integrated circuit processvariations, temperature variations, rise and fall times, and/or thermalnoise. Such relativity between items ranges from a difference of a fewpercent to magnitude differences. As may also be used herein, theterm(s) “operably coupled to”, “coupled to”, and/or “coupling” includesdirect coupling between items and/or indirect coupling between items viaan intervening item (e.g., an item includes, but is not limited to, acomponent, an element, a circuit, and/or a module) where, for indirectcoupling, the intervening item does not modify the information of asignal but may adjust its current level, voltage level, and/or powerlevel. As may further be used herein, inferred coupling (i.e., where oneelement is coupled to another element by inference) includes direct andindirect coupling between two items in the same manner as “coupled to”.As may even further be used herein, the term “operable to” or “operablycoupled to” indicates that an item includes one or more of powerconnections, input(s), output(s), etc., to perform, when activated, oneor more its corresponding functions and may further include inferredcoupling to one or more other items. As may still further be usedherein, the term “associated with”, includes direct and/or indirectcoupling of separate items and/or one item being embedded within anotheritem. As may be used herein, the term “compares favorably”, indicatesthat a comparison between two or more items, signals, etc., provides adesired relationship. For example, when the desired relationship is thatsignal 1 has a greater magnitude than signal 2, a favorable comparisonmay be achieved when the magnitude of signal 1 is greater than that ofsignal 2 or when the magnitude of signal 2 is less than that of signal1.

As may also be used herein, the terms “processing module”, “processingcircuit”, and/or “processing unit” may be a single processing device ora plurality of processing devices. Such a processing device may be amicroprocessor, micro-controller, digital signal processor,microcomputer, central processing unit, field programmable gate array,programmable logic device, state machine, logic circuitry, analogcircuitry, digital circuitry, and/or any device that manipulates signals(analog and/or digital) based on hard coding of the circuitry and/oroperational instructions. The processing module, module, processingcircuit, and/or processing unit may be, or further include, memoryand/or an integrated memory element, which may be a single memorydevice, a plurality of memory devices, and/or embedded circuitry ofanother processing module, module, processing circuit, and/or processingunit. Such a memory device may be a read-only memory, random accessmemory, volatile memory, non-volatile memory, static memory, dynamicmemory, flash memory, cache memory, and/or any device that storesdigital information. Note that if the processing module, module,processing circuit, and/or processing unit includes more than oneprocessing device, the processing devices may be centrally located(e.g., directly coupled together via a wired and/or wireless busstructure) or may be distributedly located (e.g., cloud computing viaindirect coupling via a local area network and/or a wide area network).Further note that if the processing module, module, processing circuit,and/or processing unit implements one or more of its functions via astate machine, analog circuitry, digital circuitry, and/or logiccircuitry, the memory and/or memory element storing the correspondingoperational instructions may be embedded within, or external to, thecircuitry comprising the state machine, analog circuitry, digitalcircuitry, and/or logic circuitry. Still further note that, the memoryelement may store, and the processing module, module, processingcircuit, and/or processing unit executes, hard coded and/or operationalinstructions corresponding to at least some of the steps and/orfunctions illustrated in one or more of the Figures. Such a memorydevice or memory element can be included in an article of manufacture.

The present invention has been described above with the aid of methodsteps illustrating the performance of specified functions andrelationships thereof. The boundaries and sequence of these functionalbuilding blocks and method steps have been arbitrarily defined hereinfor convenience of description. Alternate boundaries and sequences canbe defined so long as the specified functions and relationships areappropriately performed. Any such alternate boundaries or sequences arethus within the scope and spirit of the claimed invention. Further, theboundaries of these functional building blocks have been arbitrarilydefined for convenience of description. Alternate boundaries could bedefined as long as the certain significant functions are appropriatelyperformed. Similarly, flow diagram blocks may also have been arbitrarilydefined herein to illustrate certain significant functionality. To theextent used, the flow diagram block boundaries and sequence could havebeen defined otherwise and still perform the certain significantfunctionality. Such alternate definitions of both functional buildingblocks and flow diagram blocks and sequences are thus within the scopeand spirit of the claimed invention. One of average skill in the artwill also recognize that the functional building blocks, and otherillustrative blocks, modules and components herein, can be implementedas illustrated or by discrete components, application specificintegrated circuits, processors executing appropriate software and thelike or any combination thereof.

The present invention may have also been described, at least in part, interms of one or more embodiments. An embodiment of the present inventionis used herein to illustrate the present invention, an aspect thereof, afeature thereof, a concept thereof, and/or an example thereof. Aphysical embodiment of an apparatus, an article of manufacture, amachine, and/or of a process that embodies the present invention mayinclude one or more of the aspects, features, concepts, examples, etc.described with reference to one or more of the embodiments discussedherein. Further, from figure to figure, the embodiments may incorporatethe same or similarly named functions, steps, modules, etc. that may usethe same or different reference numbers and, as such, the functions,steps, modules, etc. may be the same or similar functions, steps,modules, etc. or different ones.

While the transistors in the above described figure(s) is/are shown asfield effect transistors (FETs), as one of ordinary skill in the artwill appreciate, the transistors may be implemented using any type oftransistor structure including, but not limited to, bipolar, metal oxidesemiconductor field effect transistors (MOSFET), N-well transistors,P-well transistors, enhancement mode, depletion mode, and zero voltagethreshold (VT) transistors.

Unless specifically stated to the contra, signals to, from, and/orbetween elements in a figure of any of the figures presented herein maybe analog or digital, continuous time or discrete time, and single-endedor differential. For instance, if a signal path is shown as asingle-ended path, it also represents a differential signal path.Similarly, if a signal path is shown as a differential path, it alsorepresents a single-ended signal path. While one or more particulararchitectures are described herein, other architectures can likewise beimplemented that use one or more data buses not expressly shown, directconnectivity between elements, and/or indirect coupling between otherelements as recognized by one of average skill in the art.

The term “module” is used in the description of the various embodimentsof the present invention. A module includes a processing module, afunctional block, hardware, and/or software stored on memory forperforming one or more functions as may be described herein. Note that,if the module is implemented via hardware, the hardware may operateindependently and/or in conjunction software and/or firmware. As usedherein, a module may contain one or more sub-modules, each of which maybe one or more modules.

While particular combinations of various functions and features of thepresent invention have been expressly described herein, othercombinations of these features and functions are likewise possible. Thepresent invention is not limited by the particular examples disclosedherein and expressly incorporates these other combinations.

What is claimed is:
 1. A method comprising: receiving, at a distributedstorage (DS) unit, an access request from a requesting device, theaccess request including a username and a user certificate, the usercertificate including a user certificate signature; authenticating theuser certificate; extracting, from the access request, a domain name ofa certificate authority (CA) associated with the user certificate;obtaining a CA certificate using the domain name of the CA extractedfrom the access request; validating the user certificate signature usingthe CA certificate obtained using the domain name of the CA extractedfrom the access request; and approving the access request in response toauthenticating the user certificate and validating the user certificatesignature.
 2. The method of claim 1, wherein authenticating the usercertificate includes: transmitting, from the DS unit to the requestingdevice, an authentication request specifying a task to be performed bythe requesting device using the user certificate; and receiving afavorable response to the authentication request.
 3. The method of claim2, wherein: the task to be performed by the requesting device includesproviding a signature; and the favorable response includes a validsignature.
 4. The method of claim 2, further including: transmitting anauthentication request instructing the requesting device to provide anencrypted version of original information, receiving the encryptedversion of original information from the requesting device; decryptingthe encrypted version of original information to generate decryptedinformation; comparing the decrypted information with the originalinformation; and wherein the favorable response includes a favorablecomparison between the decrypted information and the originalinformation.
 5. The method of claim 2, further including: transmittingan authentication request instructing the requesting device to perform amessage decryption; and receiving a result of the message decryptionfrom the requesting device.
 6. The method of claim 1, wherein validatingthe user certificate signature includes: performing a signaturevalidation using a public key obtained from the CA certificate.
 7. Themethod of claim 1, wherein the username is linked to the usercertificate as part of a userID.
 8. The method of claim 1, wherein theusername is linked to the user certificate using a CommonName of aSubject Distinguished Name of the user certificate.
 9. A distributedstorage (DS) unit comprising: a processor and associated memory; anetwork interface coupled to the processor and associated memory; theprocessor and associated memory configured to: receive an access requestfrom a requesting device via the network interface, the access requestincluding a username and a user certificate, the user certificateincluding a user certificate signature; authenticate the usercertificate; extract, from the access request, a domain name of acertificate authority (CA) associated with the user certificate; obtaina CA certificate using the domain name of the CA extracted from theaccess request; validate the user certificate signature using the CAcertificate obtained using the domain name of the CA extracted from theaccess request; and approve the access request in response toauthenticating the user certificate and validating the user certificatesignature.
 10. The distributed storage (DS) unit of claim 9, wherein theprocessor and associated memory are configured to authenticate the usercertificate by: transmitting, to the requesting device, anauthentication request specifying a task to be performed by therequesting device using the user certificate; and receiving a favorableresponse to the authentication request.
 11. The distributed storage (DS)unit of claim 10, wherein: the task to be performed by the requestingdevice includes providing a signature; and the favorable responseincludes a valid signature.
 12. The distributed storage (DS) unit ofclaim 10, wherein the processor and associated memory are configured to:transmit, via the network interface, an authentication requestinstructing the requesting device to provide an encrypted version oforiginal information, receive the encrypted version of originalinformation from the requesting device via the network interface;decrypt the encrypted version of original information to generatedecrypted information; compare the decrypted information with theoriginal information; and wherein the favorable response includes afavorable comparison between the decrypted information and the originalinformation.
 13. The distributed storage (DS) unit of claim 10, whereinthe processor and associated memory are configured to: transmit, via thenetwork interface, an authentication request instructing the requestingdevice to perform a message decryption; and receive a result of themessage decryption from the requesting device via the network interface.14. The distributed storage (DS) unit of claim 9, the processor andassociated memory are further configured to: validate the usercertificate signature by performing a signature validation using apublic key obtained from the CA certificate.
 15. The distributed storage(DS) unit of claim 9, wherein the username is linked to the usercertificate as part of a userID.
 16. The distributed storage (DS) unitof claim 9, wherein the username is linked to the user certificate usinga CommonName of a Subject Distinguished Name of the user certificate.17. A distributed storage network (DSN) comprising: a distributedstorage (DS) unit including a processor and associated memory; arequesting device including a processor and associated memory, andcoupled to the DS unit via a communications network; the requestingdevice configured to: generate an access request including a usernameand a user certificate, the user certificate including a usercertificate signature the DS unit configured to: in response toreceiving the access request from the requesting device, authenticatethe user certificate; extract, from the access request, a domain name ofa certificate authority (CA) associated with the user certificate;obtain a CA certificate using the domain name of the CA extracted fromthe access request; validate the user certificate signature using the CAcertificate obtained using the domain name of the CA extracted from theaccess request; and approve the access request in response toauthenticating the user certificate and validating the user certificatesignature.
 18. The distributed storage network (DSN) of claim 17, DSunit is further configured to: authenticate the user certificate by:transmitting, to the requesting device, an authentication requestspecifying a task to be performed by the requesting device using theuser certificate; and receiving a favorable response to theauthentication request.
 19. The distributed storage network (DSN) ofclaim 18, wherein: the task to be performed by the requesting deviceincludes at least one of providing a signature, encrypting information,or decrypting information; and determining whether a result of the taskto be performed by the requesting device is favorable.
 20. Thedistributed storage network (DSN) of claim 17, wherein the username isformatted as: user_name@their_auth_providers_domain.com.